Integrating Nessus with BackTrack 5's Tools
BackTrack 5, code name "Revolution", is a very popular Linux distribution used primarily for penetration testing. It contains a lot of different tools for scanning, testing, and exploiting everything from web applications to wireless networks. Since the creators of BackTrack 5 included such a vast array of tools, I thought it would be interesting to show how some of those tools can be integrated with your Nessus server to extend functionality and import results.
You can read more about this topic in The Nessus Port Scanning Engine: An Inside Look, and Web Application Scanning with Nessus.
Importing Nmap Results
There are many occasions where Nmap is used to scan specific hosts or a large network of hosts. The XML results from Nmap can be imported into Nessus and used as the basis for vulnerability scanning. If you are going to use Nmap results this way, you can disable Nessus's built-in port scanners and host identification functionality, relying solely on your Nmap results to perform the scan:
Next you will need to download the "nmapxml.nasl" script from the Tenable web site to your plugins directory:
Click for larger image
Next, re-index the plugins and restart Nessus, which will allow the new plugin to be read and show up in the "Preferences" tab:
Click for larger image
Once Nessus has restarted, you can import Nmap XML results using the following configuration screen:
For more information, see the article Using Nmap Within Nessus and the blog post Plugin Spotlight: Import Nmap XML Results Into Nessus.
When using this configuration, keep in mind that Nessus will only test the hosts and services reported by Nmap, even if you've specified additional targets when creating the scan.
Enabling Nikto
Nikto is a web application scanning tool that searches for misconfigurations, openly accessible web directories and a host of web application vulnerabilities. You can download Nikto from the CIRT web site. The first step to enable Nikto is to modify "/pentest/web/nikto/nikto.pl" and change the "configfile" variable to "/pentest/web/nikto/nikto.conf":
Click for larger image
This allows you to run the "nikto.pl" command from outside of the /pentest/web/nikto directory. Next, add "/pentest/web/nikto" to the system path:
Click for larger image
This will update the path for all services run on the host, which means when you start Nessus, nikto.pl will be in the path. The final step is to re-index the Nessus plugins (/opt/nessus/sbin/nessusd -y) and restart the Nessus service (/etc/init.d/nessusd restart). When you configure a policy, Nikto will be available in the preferences:
Click for larger image
Using Hydra
Hydra is already installed in the system path, which means it is available to Nessus "out-of-the-box" in BackTrack 5. Menu options to configure Hydra exists in the Nessus preferences when a policy is configured:
Click for larger image
You will need to supply your own username and password dictionaries. You can find some sample word dictionaries in the "/pentest/dictionaries" directory on the BackTrack 5 distribution. Be certain that you check "Always enable Hydra (slow)" in the Nessus configuration or Hydra will not run.
Conclusion
BackTrack 5 will save you some time by including all of the popular tools by default, which is quicker than downloading, installing and configuring all the tools yourself. Extending Nessus scans can come in handy when performing targeted scans against a small number of hosts. Use caution when enabling Nikto and Hydra to run scans against large networks, as they will add time to your scans. As for Nmap results, sometimes other people will run Nmap scans and want to enumerate vulnerabilities, and other times you may run Nmap yourself and decide later that a vulnerability scan is required, so the ability to import the results avoids duplication of effort.
References
Related Articles
Study: Tenable Offers Fastest, Broadest Coverage of CISA's KEV Catalog
October 23, 2023Tenable ranked first in multiple vulnerability management categories, including the most comprehensive coverage and quickest detection of CISA's Known Exploited Vulnerabilities, according to a Miercom report commissioned by Tenable.
Tuning Network Assessments for Performance and Resource Usage
September 13, 2022Using the correct tool for the job and optimizing scanner placement will have a large impact on scan efficiency with Nessus, Tenable.io and Tenable.sc.
Terrascan Joins the Nessus Community, Enabling Nessus To Validate Modern Cloud Infrastructures
May 17, 2022The addition of Terrascan to the Nessus family of products helps users better secure cloud native infrastructure by identifying misconfigurations, security weaknesses, and policy violations by scanning Infrastructure as Code repositories.
Managing OT and IT Risk: What Cybersecurity Leaders Need to Know
October 7, 2024Security leaders face the challenge of managing a vast, interconnected attack surface, where traditional approaches to managing cyber risk are no longer sufficient. Modern threats exploit vulnerabilities across domains, requiring a more holistic approach to avoid operational disruption, safety risks and financial losses.
Cybersecurity Snapshot: Many Employees Overshare Work Info with AI Tools, Report Finds, as ‘Cybersecurity Awareness Month’ Kicks Off
October 4, 2024Check out the best practices cyber agencies are promoting during Cybersecurity Awareness Month, as a report warns that staffers are feeding confidential info to AI tools. Meanwhile, a study highlights how business decisions can derail OT security. Plus, get the latest on Active Directory security, CISO salary trends and ransomware attacks!
How to Unlock Advanced IoT Visibility for Cyber-Physical Systems
October 1, 2024As the number of IoT devices deployed globally continues to rise, cyber-physical systems and business operations are exposed to greater risk. Improving asset visibility, monitoring and risk management are critical steps to preventing breaches.
- Nessus