Tenable Nessus Tips and Tricks
This post summarizes the tips and tricks I found useful during working on Tenable Nessus.
How to find out failed login hosts
A quick check:
- Plugin 19506 Nessus Scan information : Along with other information, this give you a quick summary of CREDENTIALS YES/NO
If you have a failure, then review other Plugins to find out the cause, Here are some Plugins worth looking at
- 110723 No Credentials Provided
- 110095 Authentication Success
- 104410 Authentication Failure(s) for Provided Credentials
- 110385 Authentication Success Insufficient Access
- 21745 Authentication Failure - Local Checks Not Run
- 117885 Authentication Success with Intermittent Failure
- 10394 Microsoft Windows SMB Log In Possible
Create Nessus Instance in Low End VPS
GCP Free tier:
Google Free Tier: e2-micro (0.25 -2 vcpu, 1 core, 1 GB memory)
- 1 non-preemptible
e2-micro
VM instance per month in one of the following US regions:- Oregon:
us-west1
- Iowa:
us-central1
- South Carolina:
us-east1
- Oregon:
- 30 GB-months standard persistent disk
- 1 GB of outbound data transfer from North America to all region destinations (excluding China and Australia) per month
- Compute Engine free tier does not charge for an external IP address.
Installation steps
1 Create your GCP VM
2 Connect to VM
Update system (Optional)
- apt update -y && apt upgrade -y
SWAP size increase: (Optional)
- wget https://raw.githubusercontent.com/51sec/swap/main/swap.sh && bash swap.sh
3 Install Observability - Ops Agent (Optional)
You will be able to see much more metrics from your VPS, such as memory usage.
4 Install Nessus using script
Three commands from the cli session:
- curl https://raw.githubusercontent.com/51sec/nessus-special/main/ubuntu.sh -o ubuntu.sh
- chmod +x ubuntu.sh
- ./ubuntu.sh
One line command:
- curl https://raw.githubusercontent.com/51sec/nessus-special/main/ubuntu.sh -o ubuntu.sh && chmod +x ubuntu.sh && ./ubuntu.sh
https://<Public IP>:12345
GITHUB Repository: https://github.com/51sec/nessus-special
Screenshots for oberability tab and settings page:
Total hours until all plug-ins compiled: about 9 hours (from 2pm - 11pm)
Settings:
Warning for minimum requirements not met.
Dring a scan:
CPU load is 2% and maximum memory usage is about 180MB.
Here is the GCP's observability:
Update Plugin-set:
- re-run the installation scrip.
How to Quickly Find Out OS
Plugin ID: 11936
How to quickly find out Windows machines which failed login using provided credentials?
1. Filter plugin 19506, then search "Credential Check: No" in Plugin Output column. Copy all filtered machine's IPs out to a new sheet's column.
2. Clear Filter. Filter plugin 11936, then seach "Windows" in Plugin Output column. Copy all filtered machine's IPs out to a new sheet's column.
3. Create a column "Is it windows?" to check if we can find one existing in both Columns, A & D.
共有 0 条评论