I realize Nessus is currently up to version 4 with a GUI and will probably play with that at a future date.  So I’m not sure how useful this install info will be to anybody but me.

Download

Download the following 4 packages from nessus.org, selecting Nessus 2.2.11 source code from the drop-down menu, accepting the user license.

• nessus-libraries-2.2.11.tar.gz (418 KB)
• nessus-plugins-2.2.11.tar.gz (7468 KB)
• nessus-core-2.2.11.tar.gz (664 KB)
• libnasl-2.2.11.tar.gz (359 KB)

Setup

1. Copy files to desired directory (using your favorite SFTP/SCP client) e.g., /home/nessus
2. Extract using ‘tar zxf [filename]‘
3. Run the following commands to make sure the correct directories are in your $PATH
   • echo “/usr/local/bin” >> /etc/ld.so.conf
   • echo “/usr/local/sbin” >> /etc/ld.so.conf
   • echo “/usr/local/lib” >> /etc/ld.so.conf
   • ldconfig
4. Make sure the following packages are installed
   • libc6-dev
   • openssl
   • libssl-dev
   • flex
   • bison
   • make
5. Navigate to the nessus-libraries directory and run the following as root (waiting for each to complete)
   • ./configure
   • make
   • make install
6. Repeat commands in step5 inside the libnasl directory
7. Change to the nessus-core directory and run
   • ./configure –disable-dtk (this makes it so you can only run nessus from the command line, ideal for the environment setup earlier)
   • make
   • make install
8. Change to the nessus-plugins directory and run
   • ./configure
   • make
   • make install
9. Run “/usr/local/sbin/nessus-mkcert” accepting all the default values
10. Setup Nessus user account
    • Run “/usr/local/sbin/nessus-adduser”
    • Enter a user name
    • Enter “pass” and create a password for the user
    • To set no limits with the rules use: “default accept” (if you wish to restrict certain IP ranges use something like “accept 192.168.0.0/24″ [press enter] “default deny” – this will only allow the user to run nessus on the 192.168.0.0/24 subnet, only 255 addresses, making the default rule for any other address “deny”)
11. Startup the Nessus server before you start any scans
    • nessusd -D -a 127.0.0.1

An example of a command to get you started (and I’m still starting, so I won’t expound much more) is

• nessus -q 127.0.0.1 1241 [Nessus_Username] [Nessus_Username_pass] /home/nessus/target.list /home/nessus/results.nbe -T nbe -V -c /root/.nessusrc
  • target.list contains a list of comma separated IP addresses
  • results.nbe is where the results will be stored
  • nbe is the format type (you can also use html and a few other types)
  • .nessusrc is the scan policy you use that tells nessus what to do (I haven’t got too much into how this file works yet, but plan to investigate it further)
  • run “nessus –help” if you have more questions on the structure of the command

Scanning tools are useful both to hackers and system administrators.  At work we’ll be using a tool called Discovery and Dependency Mapping which basically scans the entire network and gathers information on all the devices on the network and their dependency on eachother.  This is probably a little more advanced than Nmap, but a real-life example of sys. admins wanting to know what’s on the network.

Nmap is a very useful, free scanning utility.  The first objective is to find out what hosts are out on a network.  Issuing the command “nmap -sP 192.168.100.*” would bring back all the hosts on the 192.168.100.0 network.

example of using nmap -sP

The next step is to stack fingerprint the network using the command “nmap -sT 192.168.100.102″:

nmap -sT

To see what Nmap is doing, you can use Wireshark to capture the packets that go to and from the target computer.  Here’s an example of nmap hitting port 80 on the target computer:

This command (nmap -sT) shows you the ports open on the target system, as well as the services running on those ports.  This can help you identify what operating system the computer is running which allow you to probe deeper and find out, for example, the type of server and version.  If you’re worried about your scan showing up on the target computer’s logs (as evident in the three-way handshake completed when identifying port 80 as open in the above image), you can do a stealth mode scan with “nmap -sS x.x.x.x”.

Running the command “nmap -O x.x.x.x” will have Nmap guess the operating system on the machine.  I didn’t have much success with that command (from the command line), but using the GUI and command “nmap -T4 –version-light -sV -F -O 192.168.100.102″, it guessed the OS as Windows along with a list of possible versions.

Nmap GUI

Network traffic generated from using Nmap, shown by its signature, can be very detectable.  Nmap can be configured to mask its signature from being easily detected.

The following are a few tools of which I am currently aware.  I’ve used some, and plan to dive deeper into each of them, and hopefully discover others along the way.  I’ll republish this list as I get further along.

1. Backtrack – live CD, combination of Auditor and WHAX, tons of security/forensics tools
2. Helix – live CD, can also run as an application in Windows, forensic tools
3. SecurityDistro – more live CD’s with loads of security tools
4. WebGoat – a tutorial on web security
5. p0f – OS fingerprinting tool, for profiling your targets
6. MetaSploit – ” useful information to people who perform penetration testing, IDS signature development, and exploit research”
7. KeePass – “a free open source password manager, which helps you to manage your passwords in a secure way”
8. Wigle.net – Wireless Geographic Logging Engine