{"id":353,"date":"2024-03-02T04:14:42","date_gmt":"2024-03-02T04:14:42","guid":{"rendered":"https:\/\/hackmybox.com\/?p=353"},"modified":"2024-08-15T07:38:57","modified_gmt":"2024-08-15T07:38:57","slug":"vulnerability-management-labs","status":"publish","type":"post","link":"https:\/\/hackmybox.com\/index.php\/2024\/03\/02\/vulnerability-management-labs\/","title":{"rendered":"Vulnerability Management Labs Review"},"content":{"rendered":"\n

Contents: <\/strong><\/p>\n\n\n\n

Lab 1 : Setting up Metasploitable 2 & Scanning Using Nmap<\/strong><\/p>\n\n\n\n

Lab 2 : Vulnerability Scanning Using Nessus<\/strong><\/p>\n\n\n\n

Lab 3: WPScan Vulnerability Scanner <\/strong><\/p>\n\n\n\n

<\/p>\n\n\n\n


Lab 1 : Setting up Metasploitable 2 & Scanning Using Nmap<\/strong><\/p>\n\n\n\n

1. Download Metasploitable 2 Metasploitable download | SourceForge.net<\/a><\/p>\n\n\n\n

Metasploitable 2 is an intentionally vulnerable virtual machine created by security company Rapid7. It is designed to be a test environment and playground for ethical hackers.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

2. Download Vmdk2Vhd \u2013 I had some issues running the vm on Microsoft Hyper V so I used this to convert vmdk to Vhd<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

3. Create VM & connect VHD that we have recently converted

1.\u00a0\u00a0\u00a0\u00a0<\/span><\/span><\/p><\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

<\/p>\n\n\n\n

<\/p>\n\n\n\n

3. Add hardware \u2013 Legacy Network Adapter so it can be seen on the network.<\/p>\n\n\n\n

<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

<\/p>\n\n\n\n

5. Run to the instruction on how to use Nmap to scan VM Metasploitable 2 <\/p>\n\n\n\n

5.1 How many TCP ports are OPEN on MS2? (Use the -sT flag in Nmap).<\/p>\n\n\n\n

<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

5.2 How many UDP ports are OPEN on MS2? (Use the -sU flag in Nmap \u2013 this may take a while).<\/p>\n\n\n\n

<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

5.3 What port is running a Metasploitable Root Shell? (Use the -sV flag in Nmap).<\/p>\n\n\n\n

<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

<\/p>\n\n\n\n

Lab 2 : Vulnerability Scanning Using Nessus<\/strong><\/p>\n\n\n\n

1.Downlaod https:\/\/www.tenable.com\/products\/nessus\/nessus-essentials<\/a> and register for an activation code. <\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

<\/p>\n\n\n\n

2. Proceed with install , I installed on Microsoft Server 2022 for simplicity.<\/p>\n\n\n\n

<\/p>\n\n\n\n

<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

<\/p>\n\n\n\n

3. Once completed access the Nessus at local port 8834 then register.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

4. Activate with the provided code received in your email.<\/p>\n\n\n\n

<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

5. Once initialize, input the network to scan<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

6. View scan results<\/p>\n\n\n\n

<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

9. From the downloaded CSV, sort data by Risk (sample below with High Risk)<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

10. Additional features included on Nessus Essentials . Enjoy!<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

<\/p>\n\n\n\n

Lab 3: WPScan Vulnerability Scanner<\/strong><\/p>\n\n\n\n

1.WPScan is already installed on Kali Linux. Below is a sample of running a scan on my blog. Some add-ins need to be updated for the results.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

<\/p>\n","protected":false},"excerpt":{"rendered":"

Contents: Lab 1 : Setting up Metasploitable 2 & Scanning Using Nmap Lab 2 : Vulnerability Scanning Using Nessus Lab 3: WPScan Vulnerability Scanner Lab 1 : Setting up Metasploitable 2 & Scanning Using Nmap 1. Download Metasploitable 2 Metasploitable download | SourceForge.net Metasploitable 2 is an intentionally vulnerable virtual machine created by security company […]<\/p>\n","protected":false},"author":1,"featured_media":795,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"site-container-style":"default","site-container-layout":"default","site-sidebar-layout":"default","site-transparent-header":"default","prose-style":"enable","disable-article-header":"default","disable-site-header":"default","disable-site-footer":"default","disable-content-area-spacing":"default","footnotes":""},"categories":[12],"tags":[],"class_list":["post-353","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-labs"],"_links":{"self":[{"href":"https:\/\/hackmybox.com\/index.php\/wp-json\/wp\/v2\/posts\/353","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hackmybox.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hackmybox.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hackmybox.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/hackmybox.com\/index.php\/wp-json\/wp\/v2\/comments?post=353"}],"version-history":[{"count":13,"href":"https:\/\/hackmybox.com\/index.php\/wp-json\/wp\/v2\/posts\/353\/revisions"}],"predecessor-version":[{"id":796,"href":"https:\/\/hackmybox.com\/index.php\/wp-json\/wp\/v2\/posts\/353\/revisions\/796"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/hackmybox.com\/index.php\/wp-json\/wp\/v2\/media\/795"}],"wp:attachment":[{"href":"https:\/\/hackmybox.com\/index.php\/wp-json\/wp\/v2\/media?parent=353"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hackmybox.com\/index.php\/wp-json\/wp\/v2\/categories?post=353"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hackmybox.com\/index.php\/wp-json\/wp\/v2\/tags?post=353"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}