The document discusses various network security tools, focusing on Nessus and Nmap. Nessus is an open-source vulnerability scanner that scans for vulnerabilities on networks and hosts. It provides reports and has both free and commercial versions. Nmap is a port scanner used to discover hosts and services on a network. The document explains how Nessus and Nmap can be used together for penetration testing, with Nmap performing initial scans and Nessus following up with more detailed vulnerability assessments. Example uses of the tools for internal network scanning and web application testing are also provided.

1. Software Security
Network Security Tools
Presented by
Emanuela Boroș
“Al. I. Cuza” University, Faculty of Computer Science
Master of Software Engineering, II

2. Audit/Port Scanning Tools
● Nessus (Vulnerability scanner) #3
● SAINT (Vulnerability scanner, Based on
SATAN,developed by World Wide Security,Inc.) #110
● Sara (Security Auditor’s Research Assistant,
SANS Top 10 Threats, 1 May 2009)
● Nmap, strobe (Port scanners, strobe was one of the
earliest port scanning tools, Nmap is the strobe's
grandson)

3. Nessus
Scanner

4. Nessus Scanner
● Available from http://www.nessus.org/products/nessus/
● The world leading vulnerability scanner
● Free for home users, licensed on a yearly subscription
for commercial businesses
● Easy-to-use tool
● Linux/Solaris/Windows/Android/iPhone
● Provides HTML based reports
● Client/server architecture: clients (Windows, Unix,
Android, iPhone) & servers (Unix only)

5. Pros/Cons
Pros
● Free vulnerability scanning
● Easy to install and use
● Up-to-date security vulnerability database
● Free for home users
● Powerful plug-in architecture
Cons
● Needs activation code
● Some UI issues

6. Policies
A Nessus “policy” consists of configuration options
related to performing a vulnerability scan.
● External Network Scan
● scans externally facing hosts
● XSS plugin families
● all 65,535 ports are scanned
● Internal Network Scan
● scans large internal networks with many hosts, several exposed services, and
embedded systems such as printers
● standard set of ports is scanned
● Web App Tests
● scans for vulnerabilities present in each of the parameters, including XSS,
SQL, command injection
● Prepare for PCI DSS audits
● enables the built-in PCI DSS compliance checks that compare scan results
with the PCI standards and produces a report on your compliance posture

7. Server

8. Pros/Cons

10. Client

11. Case Studies
Version: 4.4.1
Feed Type: Home
OS: Windows 7/Android

12. Internal Network Scan
● Default policy
● scans large internal networks with many hosts, several exposed services, and
embedded systems such as printers
● standard set of ports is scanned

18. Web Application Scanning
With Credentials

19. Steps
● App that requires authentication
● Create a policy
● General - Port 80
● Preferences
● HTTP login page
● Login page and login form (may be a different form)
● Look into you html and see what name fields or you can
use a sniffer What it is used into a post request
● Ability to check for auth – login successfully with a timer
– go to this page every delay to see if you're still logged
– with a 120 seconds and you should see a regex
Logout
● Web mirroring – regular expressions to exclude things – web
spider to exclude logout.php cause that would log you out

26. Windows Scanning

27. Conclusions

30. Using Android Nessus app

36. Nmap

37. Nmap
● Insecure.Org
● free utility which can quickly scan broad ranges of devices and
provide valuable information about the devices on your network
● uses raw IP packets to determine what hosts are available on
the network
● used by attackers to scan a network and perform
reconnaisance about the types and quantities of targets
available and what weaknesses exist

38. Nmap with Nessus

39. Advantages
● smart penetration testing
● nmap the best scanner ever and nessus one of our favorite
vulnerability scanner
● effective and less time consumer

40. Case Study
Steps
● used nmap for a quick scan on the local network to all the
hosts in the subnet
● after the scan there will be different hosts and their open
ports