Integrating Nessus with BackTrack 5's Tools
BackTrack 5, code name "Revolution", is a very popular Linux distribution used primarily for penetration testing. It contains a lot of different tools for scanning, testing, and exploiting everything from web applications to wireless networks. Since the creators of BackTrack 5 included such a vast array of tools, I thought it would be interesting to show how some of those tools can be integrated with your Nessus server to extend functionality and import results.
You can read more about this topic in The Nessus Port Scanning Engine: An Inside Look, and Web Application Scanning with Nessus.
Importing Nmap Results
There are many occasions where Nmap is used to scan specific hosts or a large network of hosts. The XML results from Nmap can be imported into Nessus and used as the basis for vulnerability scanning. If you are going to use Nmap results this way, you can disable Nessus's built-in port scanners and host identification functionality, relying solely on your Nmap results to perform the scan:
Next you will need to download the "nmapxml.nasl" script from the Tenable web site to your plugins directory:
Click for larger image
Next, re-index the plugins and restart Nessus, which will allow the new plugin to be read and show up in the "Preferences" tab:
Click for larger image
Once Nessus has restarted, you can import Nmap XML results using the following configuration screen:
For more information, see the article Using Nmap Within Nessus and the blog post Plugin Spotlight: Import Nmap XML Results Into Nessus.
When using this configuration, keep in mind that Nessus will only test the hosts and services reported by Nmap, even if you've specified additional targets when creating the scan.
Enabling Nikto
Nikto is a web application scanning tool that searches for misconfigurations, openly accessible web directories and a host of web application vulnerabilities. You can download Nikto from the CIRT web site. The first step to enable Nikto is to modify "/pentest/web/nikto/nikto.pl" and change the "configfile" variable to "/pentest/web/nikto/nikto.conf":
Click for larger image
This allows you to run the "nikto.pl" command from outside of the /pentest/web/nikto directory. Next, add "/pentest/web/nikto" to the system path:
Click for larger image
This will update the path for all services run on the host, which means when you start Nessus, nikto.pl will be in the path. The final step is to re-index the Nessus plugins (/opt/nessus/sbin/nessusd -y) and restart the Nessus service (/etc/init.d/nessusd restart). When you configure a policy, Nikto will be available in the preferences:
Click for larger image
Using Hydra
Hydra is already installed in the system path, which means it is available to Nessus "out-of-the-box" in BackTrack 5. Menu options to configure Hydra exists in the Nessus preferences when a policy is configured:
Click for larger image
You will need to supply your own username and password dictionaries. You can find some sample word dictionaries in the "/pentest/dictionaries" directory on the BackTrack 5 distribution. Be certain that you check "Always enable Hydra (slow)" in the Nessus configuration or Hydra will not run.
Conclusion
BackTrack 5 will save you some time by including all of the popular tools by default, which is quicker than downloading, installing and configuring all the tools yourself. Extending Nessus scans can come in handy when performing targeted scans against a small number of hosts. Use caution when enabling Nikto and Hydra to run scans against large networks, as they will add time to your scans. As for Nmap results, sometimes other people will run Nmap scans and want to enumerate vulnerabilities, and other times you may run Nmap yourself and decide later that a vulnerability scan is required, so the ability to import the results avoids duplication of effort.
References
Related Articles
Study: Tenable Offers Fastest, Broadest Coverage of CISA's KEV Catalog
October 23, 2023Tenable ranked first in multiple vulnerability management categories, including the most comprehensive coverage and quickest detection of CISA's Known Exploited Vulnerabilities, according to a Miercom report commissioned by Tenable.
Tuning Network Assessments for Performance and Resource Usage
September 13, 2022Using the correct tool for the job and optimizing scanner placement will have a large impact on scan efficiency with Nessus, Tenable.io and Tenable.sc.
Terrascan Joins the Nessus Community, Enabling Nessus To Validate Modern Cloud Infrastructures
May 17, 2022The addition of Terrascan to the Nessus family of products helps users better secure cloud native infrastructure by identifying misconfigurations, security weaknesses, and policy violations by scanning Infrastructure as Code repositories.
Tenable and Thales Collaborate to Provide Cyber Defense Simulations to Better Secure Operational Technology Environments
April 18, 2024The heart of the Welsh Valleys is home to the Thales Ebbw Vale campus, a world-class facility jointly funded by the Welsh government as part of its regeneration program for the region. At the core of the facility is the Cyber Range, a simulation and virtualization platform for training, testing, exercising and R&D. Tenable has joined the lineup of solutions used to run real world simulations in this controlled environment.
Oracle April 2024 Critical Patch Update Addresses 239 CVEs
April 17, 2024Oracle addresses 239 CVEs in its second quarterly update of 2024 with 441 patches, including 38 critical updates.
Strengthening the Nessus Software Supply Chain with SLSA
April 16, 2024You know Tenable as a cybersecurity industry leader whose world-class exposure management products are trusted by our approximately 43,000 customers, including about 60% of the Fortune 500. But sometimes we like to give you a peek behind the curtain to share how we protect our own house against cyberattacks – and that’s what this blog is about. Today we’re sharing our experience adopting the supply-chain security framework SLSA, with the hopes that the lessons we learned will be helpful to you.
- Nessus