Nessus Guide Windows 11
Vulnerability management and its significance within an organization will be reviewed in this guide. Additionally, it will explain how to use Nessus, a vulnerability scanning tool. Finding vulnerabilities, categorizing them, and fixing them fast and simply are the goals of this tool. A host computer running Nessus and a target computer running Windows 10 will be used to do this.
Nessus: An open-source program that looks for security flaws, categorizes the threats, and provides solutions.
Installing Nessus:
Here is the link to download Nessus. Fill out the information required, then it will be e-mailed to you, from where you can go download it from.
After installation, it should open in your browser. Go ahead and log in, and your screen should look something like this:
Preparation: Another host that isn’t linked to a domain will be scanned. I’ll be using a virtual machine running Windows 11.
Navigate to Windows Defender Firewall with advanced security on the target computer. Properties of the Widows Defender firewall → Turn off the domain firewall for the public, private, and domain profiles.
Although there is a significant security risk, this should only be done for testing purposes and allows Nessus to connect to my computer. You can make a firewall rule that doesn’t block the scanner source IP if you’d like.
Go to command prompt →(targets IP address) and ping your target.
Non-Credentialed Scan:
The non-credentialed scan will be scanned on a surface level. It provides a broad overview of the target’s surroundings without delving deeply.
1. Navigate to Nessus > New Scan → Basic Network Scan to begin scanning your device. After giving your scan a name and adding an optional description, enter the target’s IP address.
In the options, you can alter your scan by scheduling it or even scanning every port by selecting Discovery → Port scan(all ports).
2. Select “Save” and then “launch Icon.” You can click on the scan to view its progress while you wait for it to finish.
As you can see, every vulnerability is color-coded to represent its level of severity.
3. To view the list of vulnerabilities the scan found, click on it. Information only states a fact and is typically not seen as a vulnerability.
Credentialed Scan:
Get Navraj Gill’s stories in your inbox
Join Medium for free to get updates from this writer.
A credentialed scan offers a comprehensive examination of the system, diving deep into the device’s foundation to identify weaknesses. To run, this scan needs administrator access and legitimate user credentials.
We will let authenticated scans on the single host target.
- Go to Services → enable remote registry. This will allow the scanner to connect and scan the registry.
Make sure the remote registry is running and is on automatic.
2. Open share across devices → Enable network discovery and file and printer sharing.
3. Go to user account control → bring the bar down to never notify. This is not good to do in a cooperative environment but rather to get the best results.
4. Open registry editor → locate the following: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system
Once you reach there, right click and press new. Create a DWORD called LocalAccountTokenFilterPolicy and make sure the value is set to 1.
Once you go back to Nessus, you can configure the same scan, or make a new one if you'd like.
Once you set up the scan, go to Credentials -> Windows, then enter the username and password of the target host.
Next, you want to save the scan, and make sure to launch.
Compared to the non-credentialed scan, the results will give you a more comprehensive and accurate analysis.
Opening up mixed, you can see there are a lot of critical and high alert ones.
If you want to fix these alert a possible remediation is updating your windows. Here I am doing a windows update.
As you can see after the windows update has finished. I re-ran the scan now there a lot less vulnerabilities within the host.
Thank you for reading my article. Hopefully you found it useful.
