Vulnerability analysis

TAREK BELDI
I. Presentation of the workshop:
Our workshop under the name of vulnerability analysis allows for identification and validation.

only the security vulnerabilities in the client's infrastructure using automated tools and
of a limited manual intervention.

Vulnerabilities are technical flaws in a component or a group of

computer components (systems, network equipment, firewalls, databases,
web applications, etc.) which, if exploited, can harm the organization (leak
confidential information, damaged image, loss of customer trust, etc.

In 2013, according to the OWASP (Open Web Application Security Project), "97% of
web applications remain exposed to known vulnerabilities, and the main associated risks
Web applications remain identical, notably SQL injections that allow for
a malicious third party to retrieve, steal, modify, or destroy sensitive information.

II. Presentation of the tools used:

In this part, we are interested in identifying the tools used in this workshop:

1. Nessus:

Nessus is the network vulnerability scanner from Tenable Network Security. Compared to the
Other vulnerability scanners, Nessus has the particularity of being based on an architecture
client/server and be compatible with Windows and Linux. In addition, Nessus stores and manages
all its security vulnerabilities through a plugins system.

Nessus is software that carries out real attacks and presents the results of these attacks.
in the form of a report. Its use can therefore be two-edged. On one side, a
security team can use it to scan its network in order to prevent intrusions
and denial of service. On the other hand, a hacker can use it for dishonest purposes and in
take advantage of the reported vulnerabilities.

1
 Nessus became proprietary software starting from version 3. However, it remained
free for non-commercial use. A free fork has been created: OpenVAS

[Link] :

OpenVAS is a new open-source project that has emerged and is underway to take the
Nessus, the popular vulnerability assessment system that has closed its source.
a few years ago.

[Link] :

Burp Suite is a Java application that can be used for security or to perform
penetration tests on web applicationsb1,2The suite consists of different
tools like a proxy server (Burp Proxy), indexing robot (Burp Spider), a tool
intrusion (Burp Intruder), a vulnerability scanner (Burp Scanner) and an HTTP repeater
(Burp Repeater).

III. Network topology:

UsethevictimmachinewithMetasploitable2_Linuxandanotherwiththevulnerabilityscanner.

IV. Tool Configuration:

1. Configuration of Burp Suite on Kali:
a) First, you need to download a professional version of Burp Suite because the
Thefreeeditionversiondoesnotincludethe'burpscanner'part.

2
From where we install a package and under its location, we open the terminal and execute like
suit

Java–[Link]

b) Open Iceweasel and click Edit then Preferences

c) The Preferences Window will open immediately, we click on

Advanced → Network → Setting

3
d) Choose Manual Proxy after writing localhost or [Link] in the part
HTTP Proxy and the port must be 8080. Check the box 'Use this'
proxy server for all protocols.” Empty the No Proxy section and click
surOK

4
e) BurpSuite is already open from step a), click on the Proxy Tab then
OptionSubtab

5
 f) Intercept Client Requests
→ Select URL Match type and click UP button until URL Match type is reached
1st place.
Check the box 'Intercept requests based on the following rules.'

g) select 'File Extension' and click on Edit

6
h) Add 'jpeg' file extension.

i) Intercept Client Responses

Check the box 'Intercept Responses based on the following rules.'

7
j) Add a new rule

k) Add a file extension

8
Put the new rule in second place.

We are done

9
Now, open your Firefox or Iceweasel and write [Link] in the area
web address. You may see a message 'This connection is Untrusted' if you
use Google via HTTPS. You can add an exception every time this happens
produced when you use a proxy, but can be annoying. We can also
define Firefox or Iceweasel to trust the Burp certificate so that we do not receive
not this Pro version error. Burp process allows us to obtain the certificate easily,
but in the free version we have to do little work. You can browse all
The https allows sites to do this. After opening https allows sites Click on "
I understand the risks

10
n) Click on Add Exception..

o) Click on View

11
p) Click on DetailsTab, select PortSwigger CA and then click.
surExport.

12
Select Desktop then click on Save.

r) open the Browser and Click on Edit then on Preferences.

13
s) Click on Advance then on Encryption Subtab then View Certificates.

14
Click on Authorities then Import.

u) Select the PortSwiggerCA and open it.

15
 v) check 'Trust this CA to identify websites' then click OK.

One can see the certification:

Yes, we want to disable Google SafeBrowsing. SafeBrowsing is enabled for a reason.

but it can cause unwanted traffic during tests so we will deactivate it. Go to
the Security tab and uncheck two blocking boxes.

16
 2. Configuration of Nessus:

You will find the installation files at this address:

[Link]

We will see the installation for a Windows system.

Wewilhavethisfile:

17
Weexecuteit:

ClickNextuntiltheendoftheinstalation,thenyouneedtocreateaNessusaccount.

To do this, go to the following address:

[Link]

18
WeclickonRegisterNow

Andfinally,wepress'Register'.

19
 Vulnerability analysis
SECURIDAY 2015 BIG DATA SECURITY

Wereceiveanemailwiththeactivationcode:

Using a browser, go to the following address:

[Link]

Confirm the security exception.

20
The installation operation has been completed and we will have:

21
 3. Configuration of OpenVas:

Installing OpenVAS on Kali:

In the terminal, we write "apt-get install openvas"

Then type "openvas-setup"

Once the openvas -setup process is completed, the OpenVAS manager, scanner, and the
GSAD services should be attentive:

22
You can simply start all the necessary services by running openvas -start

Point the browser to [Link] accept the self-signed SSL certificate and the
plugin identification information for the admin user.
The account is set up as follows:

And we will have,

23
Once the login and password are verified, we will have this interface:

Now, you need to update your RSS Vulnerability Database:

Administration > NVT Feed > Synchronize with Feed Now

24
V. A test scenario

25
 1. Manipulation with Burp Suite:
WiththeDVWAapplication,wedothefollowing:

OncliquesousProxy->Interceptisoff

26
Weright-click,

Wepressond' oanactivescan'

Onthescanner->scanqueue,wecanseetheprogress:

Andwhenthescanisfinished,weright-click->showdetails

Wewilhavethislist:

27
 Anddetails

2. Manipulation with Nessus:

Westartbysettingupthetwomachines:thefirstonewithWindowshavingNessus.
physical) and the second machine Metasploitable2_linux (the virtual machine) in the same network
with "host-only" as follows:

OnMetasploitable2:

Run the Windows machine:

The first step is to create a policy.

28
For a vulnerability scan, choose Basic Network Scan.

You are asked to choose certain options. Ports can be specified, for example.
as follows :

29
Once the Policy is created, you can create a new scan

Once the scan is started, it may take several minutes.

30
Once the scan is finished, you will be able to view a report. This will inform you of the
different vulnerabilities found, as well as their severity

OncliquesurExportcommesuit:

Then "exportPDF"

31
Thefileiscreatedasfollows:

(see annex 1)

Nessus then gives you a detailed description of the problem and a possible solution.
You will notice that the CVE identifier of the vulnerability is also present.

3. Manipulation with Open Vas:

32
WeneedtocheckthatthetwovirtualmachinesKaliandMetasploitable2-Linuxareinthesame
[Link],itguaranteesknowingthemundera
meme network.

UnderMetasploitable2-Linux :

EtsurKali:

Now let's configure our openVas:

WestartbycreatinganewTargetasfollows:

Then a new Task:

33
Andthescanbegins:

Wecanseetheprogressofthescanasfolows:

Wecanseeherethatwehavestoppedthescans.

34
 Areportisthendeliveredontheinterface:

The report is downloadable (see annex 2).

VI. Conclusion
Vulnerability analysis is an important element of security that should be prioritized.
work by any organization wishing to secure their IT infrastructure. It is
recommended by the SANS Institute as a critical control and by the US NIST
like a management control of security. The results show a variation
significant security vulnerabilities discovered by the various tools. It can be
it's useful to compare the vulnerability of scanners to antivirus solutions; they are both a
important contrôle de sécurité qui peut améliorer une posture de sécurité des organisations.
However, like with antivirus software, a vulnerability scanner will not find all the
vulnerabilities. This will be common knowledge for most in the sector of the
security performed network vulnerability tests. When you perform
the vulnerability analysis, it is necessary to verify the accuracy results (false positives)
and to actively search for things that have been missed (false negatives). My approach
recommended for vulnerability analysis consists of: refining the analysis profiles
vulnerability according to your needs carry out a detailed analysis of the results tools
secondary managed (nmap, a secondary solution for vulnerability scanning and/or
specialized tools). The use of multiple tools will provide a high level of coverage and
will help confirm the discovered vulnerabilities.

35
APPENDIX 1 :

36
37
ANNEX 2 :

38
39
40
41
42
43
44