- [Narrator] Testing systems for security issues,
is one of the most important tasks performed
by security professionals, but it can be a little tedious.
Security analysts must test for vulnerabilities,
because if they don't, hackers will.
You're much better off if you discover an issue
and correct it then if an attacker discovers it,
and exploits it.
Fortunately, vulnerability assessment tools
automate the process of vulnerability scanning.
There are three major categories of these tools,
port scanners, which simply probe a system
for open network ports, vulnerability scanners,
which check those ports for known vulnerabilities,
and application scanners that probe
deep into web applications to detect flaws.
Port scanners are the equivalent
of rattling all the doorknobs on a server,
looking for unlocked doors.
They check all the possible 65,535 network ports
on a server to see which ones might be open.
The most popular port scanning tool
is a program called Nmap, let's give it a try.
I'm going to go ahead and run Nmap
from the Linux command line.
I already have an SSH connection open to a Linux server,
and I'm going to go ahead and execute the scan.
The target of the scan is going to be
a window server that I control.
To start the scan, I type nmap, and then the IP address
of the server that I am scanning.
Once I hit enter, the Nmap scan begins to run.
Once it completes, it shows me the ports
that are open on the machine.
As I look at these scan results,
I see that two ports are open on the server,
port 80 for web connections, this is a web server,
and then port 3389, is the remote desktop protocol.
That's a service used to manage Windows Systems Remotely.
So as long as the only ports open on a server
are those that I expect, I can move on.
If I do see ports corresponding to unexpected services,
I'd probably want to go ahead and investigate those further,
possibly disabling the services that have those ports open.
Vulnerability scanners go much deeper.
Instead of simply checking to see what ports are open,
they dig into the details
of what services are using those ports.
They also have a database of
all known vulnerability exploits
and test the server to see if it contains vulnerabilities.
The reports from vulnerability scanners
provide important information for system remediation.
In the hands of an attacker however, that remediation
information can be a roadmap for exploitation.
One popular vulnerability scanning tool
is a web-based tool called Nessus.
I have that running on one of my servers.
Let's try scanning the same Windows server that we Nmapped,
using Nessus.
Here I am at the main screen of Nessus.
I'm going to go ahead and click new scan.
I'm going to choose a basic network scan,
I'm going to give it a name, we'll call it my server scan,
and then I need to type in the IP address
of the server that I am going to scan.
I'm going to go ahead, now, and click save,
and my scan has now begun.
You can see it's scheduled as an on demand scan,
I could use Nessus if I wanted to, to set-up recurring scans
at different times of the day or week,
and these green arrows indicate
that the scan is actually running.
Now Nessus scans often take a long time to finish,
so instead of waiting for this scan to finish,
I'm going to go look at an earlier version
of a scan against the same server.
When I click on that scan, it shows me
the vulnerabilities that it's identified.
There's a nice summary here, color-coded,
showing me that there were 24 informational vulnerabilities
on this server, one low priority vulnerability,
and six medium priority vulnerabilities.
There were not any critical
or high vulnerabilities found on this server.
When I click on this line, it brings me into
the detailed vulnerability listings for this server.
You can see on the report that there are
a number of issues with encryption on this server.
I should probably check those out,
and remediate those issues.
For example, if I click inside this first one,
it provides me with a detailed description
of the vulnerability and then also offers a solution
with advice on how I can actually remediate the problem.
If we return to the list of vulnerabilities,
and scroll down, you'll see that there's quite a bit
of other information about possible issues with this server.
I'm going to go ahead and click inside the
HTTP server type and version report here.
Notice it's only an informational report,
there's nothing that actually needs to be corrected.
When I look inside I see the actual output
from the vulnerability scan.
It shows me, that the Nessus vulnerability scanner,
went in and grabbed the HTTP header, the banner,
from the server, which actually reported
that it is running Microsoft Internet Information Server,
version 8.5, this could be useful information
to an attacker if that particular version of the web server
had a known vulnerability.
There's all sorts of detailed evidence
gathered within a vulnerability scan,
to help you diagnose when an issue occurs.
For example, I mentioned earlier
that the remote desktop protocol was running on this server.
If I double click on this RDP screenshot item,
you'll see that it actually captured a screenshot
of the RDP connection.
Tools like Nmap and Nessus provide system administrators
with important insight into the current
security status of their servers.
Organizations with robust security programs
use these tools regularly, and repeat scans
until they obtain satisfactory passing results.