TASK 3rd >> NESSUS INSTALLATION

NESSUS

Nessus is a program for vulnerability scanner, the feature in Nessus are listed below :

• Highspeed discovey
• Configuration auditing
• Asset profiling
• Sensitive data discovery
• Vulnearbility Analysis

Nessus could be implemented on enterprise network, inside DMZ (Demiliterazed Zone) and accross physical separated networks.

NESSUS screen shoot

Nessus is designed as web-based appliance for easy deployment and operation.

INSTALLING NESSUS

• Fist you must register for an account by entering your email on the NESSUS Web to get registration code.

        Please register which services you'd like to use (i choose home usage).

• open the terminal, do the instruction bellow.

Nessus CLI Interface

• Stop the nessus services on your system 

• Download the package from nessus provider webpage then install it.

• After installation is done, fetch the registration code which sent by nessus.com at your email.
• Add user by access menu
  APP > Vulnerability Assessment > Vulnerability Scanners > Nessus User Add
  enter the login name & password, if you want the user integrated as administrator please follow the procedure.

• Almost done, now it's time to start the NESSUS.
  
  APP > Vulnerability Assessment > Vulnerability Scanners > Nessus Start.

•  Open your browser, then open the localhost port 8834

please wait for the initializing ...............

the NESSUS is ready to use,

Now we tpracticing to get NESSUS integrated with Metaxploit (MSFCONSOLE)

• open the terminal, then type "msfconsole"

• type load nessus, to integrated both of them.

TEST by targetting the webhost

Testing the connectivity to the target webhost.

icmp test

 
TEST ----> www.isc-dojo.net

IS2C Official's Site Banner

using ZENMAP Utilities

==================================================

Starting Nmap 5.61TEST4 ( http://nmap.org ) at 2012-01-31 17:24 WIT
NSE: Loaded 87 scripts for scanning.
NSE: Script Pre-scanning.
Initiating Ping Scan at 17:24
Scanning www.is2c-dojo.net (74.125.31.121) [4 ports]
Completed Ping Scan at 17:24, 0.18s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 17:24
Completed Parallel DNS resolution of 1 host. at 17:24, 0.06s elapsed
Initiating SYN Stealth Scan at 17:24
Scanning www.is2c-dojo.net (74.125.31.121) [1000 ports]
SYN Stealth Scan Timing: About 26.05% done; ETC: 17:26 (0:01:28 remaining)
SYN Stealth Scan Timing: About 53.00% done; ETC: 17:26 (0:00:54 remaining)
Completed SYN Stealth Scan at 17:26, 113.14s elapsed (1000 total ports)
Initiating Service scan at 17:26
Initiating OS detection (try #1) against www.is2c-dojo.net (74.125.31.121)
Retrying OS detection (try #2) against www.is2c-dojo.net (74.125.31.121)
Initiating Traceroute at 17:26
Completed Traceroute at 17:26, 3.03s elapsed
Initiating Parallel DNS resolution of 11 hosts. at 17:26
Completed Parallel DNS resolution of 11 hosts. at 17:26, 5.63s elapsed
NSE: Script scanning 74.125.31.121.
Initiating NSE at 17:26
Completed NSE at 17:26, 0.00s elapsed
Nmap scan report for www.is2c-dojo.net (74.125.31.121)
Host is up (0.11s latency).
rDNS record for 74.125.31.121: tb-in-f121.1e100.net
All 1000 scanned ports on www.is2c-dojo.net (74.125.31.121) are filtered
Too many fingerprints match this host to give specific OS details
Network Distance: 12 hops

TRACEROUTE (using proto 1/icmp)
HOP RTT       ADDRESS
1   3.82 ms   192.168.88.1
2   7.72 ms   192.168.3.1
3   43.92 ms  1.subnet125-163-200.speedy.telkom.net.id (125.163.200.1)
4   40.80 ms  173.subnet125-160-15.infra.telkom.net.id (125.160.15.173)
5   70.39 ms  6.subnet118-98-59.astinet.telkom.net.id (118.98.59.6)
6   58.67 ms  62.subnet118-98-61.astinet.telkom.net.id (118.98.61.62)
7   55.45 ms  72.14.215.170
8   53.50 ms  209.85.243.156
9   100.86 ms 209.85.241.149
10  103.44 ms 209.85.243.23
11  ...
12  114.53 ms tb-in-f121.1e100.net (74.125.31.121)

NSE: Script Post-scanning.
Read data files from: /usr/local/bin/../share/nmap
OS and Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 128.46 seconds
           Raw packets sent: 2068 (94.372KB) | Rcvd: 100 (9.303KB)

is2c-dojo.net route from localhost's logical topology network

TEST ----> www.isc-dojo.com

using ZENMAP Utilities

==================================================

Starting Nmap 5.61TEST4 ( http://nmap.org ) at 2012-01-31 17:49 WIT
NSE: Loaded 87 scripts for scanning.
NSE: Script Pre-scanning.
Initiating Ping Scan at 17:49
Scanning www.is2c-dojo.com (67.222.154.106) [4 ports]
Completed Ping Scan at 17:49, 2.07s elapsed (1 total hosts)
Nmap scan report for www.is2c-dojo.com (67.222.154.106) [host down]
NSE: Script Post-scanning.
Read data files from: /usr/local/bin/../share/nmap
Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn
Nmap done: 1 IP address (0 hosts up) scanned in 3.27 seconds
           Raw packets sent: 8 (304B) | Rcvd: 0 (0B)

i guess the resource could accessed from internal network of is2c-dojo.com

TEST ----> www.spentera.com

www.spentera.com's banner

 using ZENMAP Utilities

=================================================

Starting Nmap 5.61TEST4 ( http://nmap.org ) at 2012-01-31 18:02 WIT
NSE: Loaded 87 scripts for scanning.
NSE: Script Pre-scanning.
Initiating Ping Scan at 18:02
Scanning www.spentera.com (74.81.66.104) [4 ports]
Completed Ping Scan at 18:02, 0.36s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 18:02
Completed Parallel DNS resolution of 1 host. at 18:02, 0.32s elapsed
Initiating SYN Stealth Scan at 18:02
Scanning www.spentera.com (74.81.66.104) [1000 ports]
Discovered open port 995/tcp on 74.81.66.104
Discovered open port 80/tcp on 74.81.66.104
Discovered open port 21/tcp on 74.81.66.104
Discovered open port 53/tcp on 74.81.66.104
Discovered open port 25/tcp on 74.81.66.104
Discovered open port 443/tcp on 74.81.66.104
Discovered open port 993/tcp on 74.81.66.104
Discovered open port 143/tcp on 74.81.66.104
Discovered open port 110/tcp on 74.81.66.104
SYN Stealth Scan Timing: About 19.30% done; ETC: 18:05 (0:02:10 remaining)
Increasing send delay for 74.81.66.104 from 0 to 5 due to 11 out of 22 dropped probes since last increase.
SYN Stealth Scan Timing: About 22.15% done; ETC: 18:07 (0:03:34 remaining)
SYN Stealth Scan Timing: About 25.00% done; ETC: 18:08 (0:04:33 remaining)
Increasing send delay for 74.81.66.104 from 5 to 10 due to 11 out of 11 dropped probes since last increase.
SYN Stealth Scan Timing: About 27.90% done; ETC: 18:09 (0:05:13 remaining)
SYN Stealth Scan Timing: About 30.75% done; ETC: 18:10 (0:05:40 remaining)
SYN Stealth Scan Timing: About 35.55% done; ETC: 18:11 (0:06:06 remaining)
SYN Stealth Scan Timing: About 54.30% done; ETC: 18:12 (0:04:21 remaining)
SYN Stealth Scan Timing: About 63.10% done; ETC: 18:13 (0:03:52 remaining)
SYN Stealth Scan Timing: About 69.80% done; ETC: 18:13 (0:03:20 remaining)
SYN Stealth Scan Timing: About 76.15% done; ETC: 18:14 (0:02:45 remaining)
SYN Stealth Scan Timing: About 81.90% done; ETC: 18:14 (0:02:09 remaining)
SYN Stealth Scan Timing: About 91.30% done; ETC: 18:13 (0:00:59 remaining)
Completed SYN Stealth Scan at 18:13, 676.50s elapsed (1000 total ports)
Initiating Service scan at 18:13
Scanning 9 services on www.spentera.com (74.81.66.104)
Completed Service scan at 18:13, 5.00s elapsed (9 services on 1 host)
Initiating OS detection (try #1) against www.spentera.com (74.81.66.104)
Retrying OS detection (try #2) against www.spentera.com (74.81.66.104)
Initiating Traceroute at 18:14
Completed Traceroute at 18:14, 9.05s elapsed
Initiating Parallel DNS resolution of 1 host. at 18:14
Completed Parallel DNS resolution of 1 host. at 18:14, 0.03s elapsed
NSE: Script scanning 74.81.66.104.
Initiating NSE at 18:14
Completed NSE at 18:16, 144.42s elapsed
Nmap scan report for www.spentera.com (74.81.66.104)
Host is up (0.31s latency).
rDNS record for 74.81.66.104: server28.web-hosting.com
Not shown: 990 filtered ports
PORT    STATE  SERVICE    VERSION
21/tcp  open   ftp?
|_ftp-bounce: no banner
25/tcp  open   smtp?
|_smtp-commands: Couldn't establish connection on port 25
53/tcp  open   domain?
80/tcp  open   http?
110/tcp open   pop3?
143/tcp open   imap?
| imap-capabilities:
|_  ERROR: Failed to connect to server
443/tcp open   https?
|_ssl-cert: TIMEOUT
587/tcp closed submission
993/tcp open   imaps?
|_ssl-cert: TIMEOUT
995/tcp open   pop3s?
|_ssl-cert: TIMEOUT
OS fingerprint not ideal because: Didn't receive UDP response. Please try again with -sSU
No OS matches for host

TRACEROUTE (using port 587/tcp)
HOP RTT     ADDRESS
1   8.69 ms 192.168.88.1
2   ... 30

NSE: Script Post-scanning.
Read data files from: /usr/local/bin/../share/nmap
OS and Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 845.94 seconds
           Raw packets sent: 2357 (108.272KB) | Rcvd: 530 (49.723KB)

Topology Map from localhost to www.spentera.com

only "submission" service is closed, the other sevices are opened.

TASK 2 INFORMATION GATHERING

Network Analysis

Analysis at local network id : 192.168.1.0/24

NMAP UTILITIES

utilities for analize the service that running by host id, running in command line interface.

checking the service that running on ip : 192.168.1.1/24

ZENMAP UTILITIES

utilities for analize the service that running by host id, running in graphical user interface.

checking th service that running on ip : 192.168.1.1/24

NETIFERA UTILITIES
utilites for analyze the transport protocol that running on the host id

checking the sevice that running on ip : 192.168.1.1/24

AUTOSCAN UTILITIES
Utilities for analyze the host that joining in the network and descript the running service each host.

Checking the services that running on ip : 192.168.1.1/24

WIRESHARK UTILITIES
Utilies for analyze the network traffic, we could use the captured activity to decode it for accuiring the information.

select the interface to obseverve activity over network id : 192.168.1.0/24

listening the activity over network id : 192.168.1.0/24

save the capture activity

XPLICO UTILITIES
Utilities for decode the captured activity from wireshark utilities

open link on the localhost id

insert the new case information

click the case to add scenario

give information at the session name colom

click at the session name

find the captured file from wireshark utilities to analyze

upload the captured file from wireshark utilities to analyze

click the send file button to confirm upload captured file

the information from captured file is decoded.

SUMMARY.

Analyzing the target host need much effort to do, we must use many utilities to accuiring information precisely.

CYBER CRIME

Denial of Service (DOS)

DOS is a motive for the attack in the form of blocking legitimate users to use their services, the attackers install malicious software that overwhelm a server service access, so that the legally user are prevented from accessing their services.

Distributed DOS is the motive for the attack where the attacker to install malicious software on someone else's computer then the software is run remotely unnoticed by the owner of that computer. and malicious software attacks the attacker targeted services.

Reflected Distributed DOS is the motive for the attack where the attacker does't matter who the target computer that will be used to attack the target services.

The DOS attack divided five basic way:

(http://en.wikipedia.org/wiki/Denial-of-service_attack)

• Consumption of computational resources, such as bandwidth, disk space, or processor clock time.
• Disruption of configuration information, such as routing information.
• Disruption of state information, such as unsolicited resetting of TCP sessions.
• Disruption of physical network components.
• Obstructing the communication media between the intended users and the victim so that they can no longer communicate adequately.

to avoid the DOS attacks we should enable the firewall service on our system.

TASK 01. OS Installation over the Virtual Machine

TASK 01.

Install Operating System over VirtualBOX (Virtual Machine).

Install OS Microsoft Windows XP SP.3
-----------------------------------------------------------------------------------------------------------------------------------

• Prepare the Virtual Machine configuration to meet the system requirement an Operating system.

Click new button to create the virtual machine for the host of OS Installastion.

Give the Virtual Machine a name, to identify the virual machine.

Set the amount of memory Host to Guest less than 50% from the total physical RAM.

Set-up the virtual HardDrive

Check the VDI radio button to select, then click Next.

for the flexibility usage virtual media storage choose the dynamicaly allocated.

Set amount of virtual HardDisk, at least 10GB

The summary of the configuration virtual machine, click "Create" button to pursue the scenario.

The creation of the virtual macine process is DONE!

• Setting the boot order.

Click the "SETTING" icon

Access the storage configuration, then click for the "empty" IDE Controller.

Click the CD-icon at the attribut section to choose the location of the ISO Installation.

Click the installation file, then click "OPEN" button to load it.

Do not forget to checklist Live CD/DVD option, for the autorun usage.

Press START button to proceed the Installation process.

• OS Microsoft Windows XP SP.3 Installation

loading file setup

Read the instruction, press ENTER to set-up mode.

End User Agreement, read the instruction bottom of page, press F8 -key to accepting the agreeement.

Read the instruction, put the cursor light on the unpartitioned space, then press C to create partition.

Give the amount size for the first (C) partition,

Highlight the unpartitioned space by your cursor, then press C-key to create File/Data partitition.

Give the rest of amount size left by.

Highlight the C Partition, then press ENTER key to install the OS on it.

Format the system partition with the NTFS File System

After the Format is done, now the installation process copying file-file set-UP of the Operating System.

Please wait, :D

Change the setting if necessary ...

Fill the information as necessary ....

fill the Serial Number to countinue the installation.

Give the unique name for the computer and uniquee password

Set the Date and Time, also Time Zone Configuration

Pelase wait .....

Setup the Network Configuration if necessary ......

Define the network domain.

Please wait ......, almost done!

After the System "RESTART" you will see the welcome screen and then insert the password to entering the system.

Check the start menu and some basic management function to assuring that our installation is success!

===================================================

OS UBUNTU 10.04 Installation.

• Prepare the Virtual Machine configuration to meet the system requirement an Operating system.

Click Next to begin the preparation...

Fill the name colom and the OS type.

Set amount of alocation memory for virtual machine less than 50% from total physical memory

Set-up the virtual hardDisk

Set the type of the Virtual HardDisk.

    

Give at least 8GB

The summary of our virtual hardDisk information

The Summary of our Virtual Machine information, click "Create" button to countinue ..

Welldone! our Virtual PC is created!

Before the installation process is began, configure the media installation first.

Target the Installation File, then click OPEN button,

Checklist on Live CD/DVD option, then click OK button to countinue.

Click the Start Button to start our installation process..

After the system restart, the splash screen appeared, pelase wait .......

Choose the language installer then Click "INSTALL UBUNTU 10.04 LTS" to proceed

Setting the Region and Time Zone (hints : click around the map).

Configure to meet your current keyboard Setting.

This is part of the partitioning HardDisk, Click the "SPECIFY PARTITIONS MANUALY", then click Forward button.

Click the Free Space, then Click the Forward Button

Set the size of "/" (root) partition at least 5GB, configure to use EXT4 File System.

The green part (sda1) is the location for the file-file system OS, click the free space to make another partition.

Give 1024MB from hardDisk used for SWAP AREA (virtual memory)

As we seen on the illustration above, the SWAP AREA Partition is colored by Orange.

The last amount of free space on hardDisk configured to be home partition (/home).

Green = /Root ; Orange = SWAP ; Blue = /Home. Click the Forward button to countinue.

The summary of the system specification already to be installed on our virtual machine.

Please wait........., :D

The System is Installed, press ENTER to restart your system, and don't forget to eject media installation.

Restart the System.

• Connecting the Host and The Guest

Open File --> Network, add the Host only network to attach the communication interface on virtualBox.

Setting the Guest Network (UBUNTU) Attached to Host-only Adapter.

Connection success! :D

Setting the Guest Microsoft Windows XP Attached to Host-only Adapter.

had a problem in connection .... :/

What a problem ....... Diver not Support!, try to install from other resource but the problem still exist.

After diagnosting (almost 5 hours), i commited to Reinstaling the OS (repair mode), then i try to reinstall the driver again.......

The Connection is Established! Alhamdulillah....., what a something :D