Kali linux - Nessus

Nessus rocks so its a must on a pentesting box.. so here we go, installation/configuration/quick guide for the lazy..

cd ; wget http://goo.gl/CDTb5 -O Nessus-5.0.3-debian6_amd64.deb
dpkg -i Nessus-5.0.3-debian6_amd64.deb

and you will get...

All plugins loaded

 - You can start nessusd by typing /etc/init.d/nessusd start
 - Then go to https://localhost:8834/ to configure your scanner

dont forget to

rm Nessus-5.0.3-debian6_amd64.deb

go to Nessus HomeFeed (if you are a home user) and register to receive the activation code (xxxx-xxxx-xxxx-xxxx-xxxx)

Now you can go to https://localhost:8834 and continue with the setup.

If you want to use it from another box and you applied the simple firewall I recommended here  don't forget to allow traffic to that port by adding after the last line

iptables -A INPUT -p tcp --dport 8834 -m state --state NEW -j ACCEPT

and then running the script again.

After you setup the product, put in the key-code you will see the admin interface.. which is lovely but... everybody loves metasploit so...

/etc/init.d/postgresql start
/etc/init.d/metasploit start

msfconsole
msf >

All we need to do now is load the plugin...

load nessus

Authenticate with our server...

nessus_connect admin:password@localhost:8834

Check out the existing scan policies

nessus_policy_list

And kick off our scan using the External Network Scan policy (-4)

nessus_scan_new -4 Target1 <ip>

We can check to see how its going with

nessus_scan_status

When the scan will finish we can run

nessus_report_list

And finally

nessus_report_get <id_of_the_scan>

Now you can see that the resuls of the scan have been imported on metasploit (just run 'hosts' and 'services' and you will see the new data.

If you want to see the results on the console you can always run

nessus_report_host_detail <ip> <port> tcp <report_id>


More to come :)