Lab 10 - vulnerability scanning
Learning Objectives
This exercise is an introduction to a vulnerability scanner called the Open
Vulnerability Assessment System, OpenVAS. Initially you will sweep the Team and
Common Network for reachable hosts. Then you will scan several hosts to determine
their open services, fingerprint the operating systems and applications, and listting
known vulnerabilities. Finally, you will choose a few vulnerabilities for which you
will find known attacks.
Materials and Setup
- openvas
Topology
Lab Steps
This exercise is an introduction to a vulnerability scanner called the Open
Vulnerability Assessment System, OpenVAS. Initially you will sweep the Team and
Common Network for reachable hosts. Then you will scan several hosts to determine
their open services, fingerprint the operating systems and applications, and listting
known vulnerabilities. Finally, you will choose a few vulnerabilities for which you
will find known attacks.
Part 1 - Sweeping the network with nmap
Set-up
Set up your exercise environment according to the specifications below, and annotate
Figure 1 accordingly. The setup for this exercise is identical to that of Lab 10-1
The Common Network is defined by 10.27.0.0/16, with the following host
specifications:
Your Linux VM address is 10.27.x.10
Your Windows VM address is 10.27.x.20
A Server at 10.27.x.1
A Printer at 10.27.0.8
A Mystery machine at 10.27.0.?
Test your network configuration by pinging the Sever VM from both your Linux VM
and your Windows VM..
Network Reconnaissance
Recall from Lab 6 Part 1 the use of nmap to sweep networks for reachable hosts.
(#19) Record the hosts that are "up". There should be at least ten student machines as
well as two or three others.
(#20) If you do a quick Operating System detection scan (using the -O switch), can
you tell which is which?
(#21) Identify the machines below by providing their IP address.
Server VM
Mystery Machine
Your Windows VM
One colleague's Linux VM
Part 2 - Vulnerability scanning with OpenVAS
OpenVAS is a framework of several services and tools offering a comprehensive and
powerful vulnerability scanning and vulnerability management solution. It advertises
itself as, "The world's most advanced Open Source vulnerability scanner and
manager." We will use OpenVAS to conduct a vulnerability assessment of the
machines identified as part of the network reconnaissance conducted above.
Run the following script to run OpenVAS.
openvas.sh
This will take a few minutes to execute. When it does, accept the browser certificate.
State that you understand the risks, and add exception.
Login using the username admin and password admin.
OpenVAS will open in a browser window and appear as depicted in Figure 2 below.
Figure 2 - OpenVAS
OpenVAS is a GUI-based application and is relatively easy to use once you learn a
few basic functions. Before you begin feel free to explore the various functions
available within OpenVAS; i.e., Scan Management, Asset Management, etc.
Learn how to conduct a simple scan by following the steps below to scan your Server
VM:
Create a new target
Configuration -> Targets
Select a New Target
Provide a name for the new target
Manually enter the host target's IP number
Select the OpenVAS Default port list
Create the target
Create a new task using this target with a defaults scan configuration
Scan Management -> New Task
Provide a name for the new task
Select the "Full and fast" scan configuration
Select the new target above as the scan target
Select the default settings for the remainder
Create the task
Start the scan task
Scan Management
Select the named task
Start the scan
This will likely take several minutes, especially since you are not the only one
scanning the network.
Review the results
View the ongoing results
Periodically refresh the results until the task completes
View the details
Save the report.
When the scan has completed select all three categories of threat: High, Medium and
Low
Within the Report Summary
Select a TXT format report and download it
Move this report to your Desktop and rename it with a meaningful name.
Now create the targets and tasks necessary to scan the remainder of the machines
identified during the reconnaissance phase.
Run these scans
While you are waiting for your scans to return results, try to determine if you are
being scanned.
For example, if you observe the network traffic by running tcpdump you will note that
there are a lot of packets traversing the network. This is not that helpful.
Experiment with tcpdump filters until you think you have captured evidence of your
host being scanned, or have confirmed that you are not being scanned.
Hint: it will help if you can figure out how to filter out your own scanning activity.
(#22) Record your successful tcpdump filter command.
Part 3 - Vulnerability assessment
When you have completed all OpenVAS scanning review the results for each host.
(#23) Summarize the results by threat category for each host and reproduce the table
below in your report.
Identification Network IP High Treats Medium Low Threat
Threats
Explore the high threat vulnerability findings for each host scanned.
(#24) For any three of these high threat vulnerabilities, summarize in your own words
the service that is vulnerable, why it is vulnerable, what exploit might the
vulnerability allow and what mitigation is required to reduce or eliminate the
vulnerability.
(#25) Which host do you feel is the most vulnerable? Why?
Record at least three Common Vulnerability Exposure identifiers for later
investigation; ie CVE-2007-xxxx.
