"Go" nessus vulnerability scanning Tutorial installation Nessus tools

Reprint Address: Http://my.oschina.net/u/1585857/blog/477035#OSC_h1_1

Nessus Vulnerability Scanning Tutorial installation Nessus tools

Nessus Vulnerability Scanning Tutorial Installing the Nessus tool

Catalogue [-]

• Nessus Vulnerability Scanning Tutorial installation Nessus tools
• Nessus Basic Knowledge
• Nessus Overview
• Installing the Nessus tool
• Get Nessus Package
• Nessus tools to install under Windows
• Nessus Tools installed under Linux

Nessus Vulnerability Scanning Tutorial installation Nessus Tools Nessus Basics

Nessus claims to be the world's most popular vulnerability scanner, with more than 75,000 organizations worldwide using it. The tool provides a complete computer vulnerability scanning service and updates its vulnerability database at any time. Nessus different from the traditional vulnerability scanning software, Nessus can be at the same time on the local or remote control, the system of vulnerability analysis scan. For penetration testers, Nessus is one of the essential tools. Therefore, this chapter introduces the basics of Nessus tools.

Nessus Overview

Nessus typically includes thousands of latest vulnerabilities, a wide variety of scanning options, and an easy-to-use graphical interface and effective reporting. Nessus is popular because the tool has several features. As shown below:

• Q provides a complete computer vulnerability scanning service and updates its vulnerability database at any time.

• Q differs from the traditional vulnerability scanning software. Nessus can be simultaneously in the local or remote control, the system of vulnerability analysis scan.

• Q The efficiency of its operation is adjusted with the resources of the system. If the host is configured with more resources (such as accelerating CPU speed or increasing memory size), its efficiency performance can be increased by enriching resources.

• Q You can define your own plugins.

• Q NASL (Nessus Attack Scripting Language) is a language issued by tenable that is used to write Nessus security test options.

• Q fully supports SSL (Secure Socket Layer).

Installing the Nessus tool

In order to successfully use the Nessus tool, you must install the tool in the system. The Nessus tool is not only available on your computer, but also on your phone. This section describes how to install Nessus tools on different operating system platforms and mobile phones.

Get Nessus Package

Before you install the Nessus tool, you first get the installation package for the tool. Also, after the Nessus tool is installed, it must be activated before it can be used. Therefore, the methods for obtaining Nessus installation packages and activation codes are described below.

1. Get the Nessus installation package

The official Nessus is:

Http://www.tenable.com/products/nessus/select-your-operating-system

Entering the above address in the browser will open the interface shown in 1.1.

Figure 1.1 Download Nessus Package

From this interface, you can see that there are two versions of Nessus, Home (home) and Professional (Professional Edition). The differences between the two versions are as follows:

• Q Home Edition: The Home Edition is free, mainly for non-commercial or personal use. This version is more suitable for personal use and can be used in non-professional environments.

• Q Pro: Professional Edition is required for payment. However, it can be used for seven days free of charge. This edition is primarily intended for commercial use. It includes technical support or additional features, such as wireless concurrent connections.

For most people, the features of the Home Edition can be fulfilled. So, here's the option to download the home version. In this interface click the Download button under Nessus Home and the interface shown in 1.2 will be displayed.

Figure 1.2 Download Nessus package for various platforms

From this interface can be seen, the official website provides a variety of platform Nessus tools installation package, such as Windows, Mac OS X, Linux, FreeBSD and so on. Users can choose the corresponding installation package according to their operating system and architecture. For example, to download a package for a Windows 64-bit schema, click Nessus-6.3.7-x64.msi. When you click the package, the dialog box shown in 1.3 pops up.

Figure 1.3 License Agreement dialog box

This interface shows the license agreement information for downloading the Nessus software package. Click the Agree button here to start the download.

2. Get the Activation code

Before using Nessus, you must activate the service before you can use it. If you want to activate the Nessus service, you need to get an activation code on the official website. The method to get the activation code is described below. The procedure is as follows:

(1 Enter the following address in the browser:

Http://www.nessus.org/products/nessus/nessus-plugins/obtain-an-activation-code

After successfully accessing the link above, the interface shown in 1.4 will open.

Figure 1.4 Getting the activation code

(2 in the interface, click the Register Now button under Nessus Home free and the interface shown in 1.5 will be displayed.

Figure 1.5 Registration information

(3 ) Fill in the information in this interface, in order to get the activation code. In this interface first name and last Name text box, the user can fill in any. However, the text box under email must fill in a valid email address to get the message. When the above information is set to complete, click the Register button. Next, you will receive a message about Nessus in the registered mailbox. Enter the mailbox to open the received message, you will see a bunch of numbers, like xxxx-xxxx-xxxx-xxxx, the activation code.

(4 Once the Nessus tool has been successfully installed, you can activate the service using the activation code obtained above.

Nessus tools to install under Windows

"Example 1-1" below describes how to install the Nessus tool under Windows. The procedure is as follows:

(1 Double-click the downloaded installation package and the Installation Wizard dialog box will pop up, as shown in 1.6.

(2 The dialog box displays some welcome information. At this point, click the Next button and the License Agreement dialog box will pop up, as shown in 1.7.

Figure 1.6 Installation Wizard Dialog Diagram 1.7 License Agreement dialog box

(3 This interface shows the license information for installing Nessus. At this point, select the I accept the terms in the License Agreement radio button. Then click the Next button, which will pop up the installation Location dialog box, shown in 1.8.

(4 This interface allows you to select the installation location of the Nessus tool, which is installed by default in the C:\Program files\tenable\nessus\ directory. If the user wants to install to a different location, click Change ... button to select its installation location. In this example, using the default installation location and clicking the Next button will pop up the ready to Install dialog box, shown in 1.9.

Figure 1.8 Selecting the Installation Location dialog box 1.9 preparing the installation dialog

(5 The interface prompts you to begin installing the Nessus tool. At this point, click the Install button to begin the installation. After the installation is complete, the Installation Completion Wizard dialog box will pop up, as shown in 1.10.

(6 From this interface , you can see that the Nessus tool has been installed. At this point, click the Finish button, exit the Installation Wizard interface, will automatically open in the Web page continue to configure the interface, shown in 1.11.

Figure 1.10 Installation Complete dialog box 1.11 Welcome to use Nessus

(7 the interface prompts for access to the Nessus service via the SSL protocol, which in this interface clicks the clicking here Link, which opens the interface shown in 1.12.

Figure 1.12 Security Certificate

(8 The interface prompts for a certificate error because the site uses an untrusted, self-signed SSL certificate. If you are sure that the site is not a problem, click the Continue this Web site option and the interface shown in 1.13 will be displayed.

Figure 1.13 Welcome information Figure 1.14 Initializing user settings

(9 This interface displays the welcome information for the Nessus tool. At this point, click the Continue button and the interface shown in 1.14 will be displayed.

(Ten This interface is used to create an account, and the user manages the Nessus service. This creates a user named admin and sets a password for the user. When the settings are complete, click the Continue button to display the interface shown in 1.15.

Figure 1.15 Fill in the activation Code figure 1.16 Load Nessus plug-in

( One in this interface activation code corresponding to the text box, enter the previously obtained activation code. Then, clicking the Continue button will start loading the plug-in in Nessus, as shown in 1.16.

( from this interface, you can see that the plugin is being downloaded and initialized. This process takes about 10 minutes. When the initialization is complete, the interface shown in 1.17 is displayed.

( in The interface is the login Nessus service interface. The user name and password entered in this interface are the users and passwords created during the previous initialization process. Once you have entered your username and password, you can successfully log in to the Nessus service by clicking the Sign In button.

tip: The Nessus Service login interface in the above process is automatically ejected. You will need to log back in when the user is closed. At this point, the user in the browser input https://IP:8834/or https://hostname: 8834/Address, you can open the interface shown in 1.12. Then, select the Continue browsing this site option to open the login page.

Figure 1.17 Login Nessus Service

Nessus Tools installed under Linux

"Example 1-2" Below is an example of Rhel 6.4, which describes how to install the Nessus tool under Linux. The procedure is as follows:

(1 ) Download the installation package from the official website. The installation package file that is downloaded in this example is named nessus-6.3.7-es6.i386.rpm.

(2 ) Copy the downloaded installation package to Rhel 6.4, which is copied under/root in this example. Next, you can install the Nesus tool. The execution commands are as follows:

• [Root@server ~]# RPM-IVH nessus-6.3.7-es6.i386.rpm

• Warning:nessus-6.3.7-es6.i386.rpm:header V4 rsa/sha1 Signature, key ID 1c0c4a5d:nokey

• Preparing ... ########################################### [100%]

• 1:nessus ########################################### [100%]

• Unpacking Nessus Core Components ...

• NESSUSD (Nessus) 6.3.7 [build M20026] for Linux

• Copyright (C) 1998-2015 tenable Network Security, Inc.

• Processing the Nessus plugins ...

• [##################################################]

• All plugins loaded (1SEC)

• -You can start NESSUSD by Typing/sbin/service NESSUSD start

• -Then go to https://Server:8834/to Configure your scanner

Seeing the output of similar information above indicates that the Nessus tool installation is complete. Next, users can access the Nessus service by entering https://Server:8834/or https://IP:8834 in the address bar of the browser.

tip: on Linux systems, the Nessus tool is installed by default in the/opt/nessus directory.

Similarly, if you want to use the Nessus tool under Linux, you need to activate the service first. Where the activation method is the same as the activation method under Windows. The only difference is that the way you trust certificates differs. As shown below:

(1 Enter https://IP:8834 in the browser address bar of Rhel 6.4 to access the Nessus service. In this case, the IP address of the host is 192.168.1.102, so the address entered is https://192.168.1.102:8834/. After you enter the address in the browser address bar, the interface shown in 1.18 opens.

Figure 1.18 Connection untrusted Figure 1.19 Understanding risk

Note: The Nessus service uses the HTTPS protocol, not the HTTP protocol.

(2 The interface shows that the connection is not trusted. This is because Nessus is a secure connection (HTTPS protocol), so it needs to be trusted before it is allowed to log on. At this point, click the "I am fully aware of the possible risks" option in the interface and the interface shown in 1.19 will be displayed.

(3 This interface shows the possible risks to the connection. At this point, click the Add Exception button to display the interface shown in 1.20.

Figure 1.20 Adding a security exception Diagram 1.21 nessus Welcome screen

(4 Click the Confirm Security Exception button in the interface and the interface shown in 1.21 will be displayed.

(5 Next, the same way you would activate Nessus under Windows. So, don't repeat it here.

"Go" nessus vulnerability scanning Tutorial installation Nessus tools