Loading...

Messages

Proposals

Stuck in your homework and missing deadline? Get urgent help in $10/Page with 24 hours deadline

Get Urgent Writing Help In Your Essays, Assignments, Homeworks, Dissertation, Thesis Or Coursework & Achieve A+ Grades.

Privacy Guaranteed - 100% Plagiarism Free Writing - Free Turnitin Report - Professional And Experienced Writers - 24/7 Online Support

How to find vulnerabilities with nmap

07/12/2021 Client: muhammad11 Deadline: 2 Day

JONES & BARTLETT LEARNING INFORMATION SYSTEMS SECURITY & ASSURANCE SERIES

LABORATORY MANUAL TO ACCOMPANY

Managing Risk in Information Systems

VERSION 2.0

Powered by vLab Solutions

INSTRUCTOR VERSION

Copyright © by Jones & Bartlett Learning, LLC, an Ascend Learning Company - All Rights Reserved.

Lab #5 Identifying Risks, Threats, and Vulnerabilities in an IT Infrastructure Using Zenmap® GUI (Nmap) and Nessus® Reports

Introduction

Imagine a system administrator learns of a server’s vulnerability, and a service patch is available to solve it. Unfortunately, simply applying a patch to a server is not assurance enough that a risk has been mitigated. The system admin has the option of opening the application and verifying that the patch has raised the version number as expected. Still, the admin has no guarantee the vulnerability is closed, at least not until the vulnerability is directly tested. That’s what vulnerability scanners are for.

Two vulnerability scanners available to the system administrator are Nmap® and Nessus®, which produce scan reports. The purpose of using Zenmap® GUI (Nmap) and Nessus® reports is to enable you to create network discovery port scanning reports and vulnerability reports. These reports can identify the hosts, operating systems, services, applications, and open ports that are at risk in an organization.

In this lab, you will look at an Nmap® report and a Nessus® report. You will visit the

http://cve.mitre.org Web site, you will define vulnerability and exposure according to the site,

and you will learn how to conduct searches of the Common Vulnerabilities and Exposures (CVE)

listing.

Learning Objectives

Upon completing this lab, you will be able to:

Review a Zenmap® GUI (Nmap) network discovery and port scanning report and a Nessus®

software vulnerability report.

Identify hosts, operating systems, services, applications, and open ports on devices from the

Zenmap® GUI (Nmap) scan report.

Identify critical, major, and minor software vulnerabilities from the Nessus® vulnerability assessment scan report.

Visit the Common Vulnerabilities and Exposures (CVE) online listing of software vulnerabilities at http://cve.mitre.org and learn how to conduct searches on the site.

41

( Copyright © by Jones & Bartlett Learning, LLC, an Ascend Learning Company - All Rights Reserved. )

43

Hands-On Steps

Note:

This is a paper-based lab. To successfully complete the deliverables for this lab, you will need access to Microsoft® Word or another compatible word processor. For some labs, you may also need access to a graphics line drawing application, such as Visio or PowerPoint. Refer to the Preface of this manual for information on creating the lab deliverable files.

3. Review the Lab 5 Nmap Scan Report that accompanies this lab.

4. Using the Lab 5 Nmap Scan Report, answer the following questions:

 What are the date and timestamp of the Nmap host scan?

 What is the total number of loaded scripts for scanning?

 A synchronize packet (SYN) stealth scan discovers all open ports on the targeted host.

How many ports are open on the targeted host for the SYN stealth scan at 13:36?

 Identify hosts, operating systems, services, applications, and open ports on devices from the Zenmap GUI (Nmap) scan report.

Why Nmap Became Popular

Nmap started more than 15 years ago as a simple, command-line tool. Its one purpose—to send crafted packets to a targeted Internet Protocol (IP) address to determine what ports are listening for connections. Knowing what specific ports are listening, the Nmap operator can infer what services are running.

For example, if Transmission Control Protocol (TCP) port 80 is open and listening, it’s a safe assumption the target machine is a Web server, running the Hypertext Transfer Protocol (HTTP) service on port 80. Other popular ports such as 21, 25, 137, and 161 mean the services File Transfer Protocol (FTP), Simple Mail Transfer Protocol (SMTP), Network Basic Input/Output System (NetBIOS), and Simple Network Management Protocol (SNMP) are listening, respectively. This made Nmap very popular with administrators who could then monitor and verify their systems’ services.

Nmap also became very popular as an easy tool for reconnaissance. With malicious intent, a person armed with knowing what services were running could research what vulnerabilities to exploit. The fast scanning Nmap made locating the recently discovered exploits called zero-day exploits very efficient.

Copyright © 2015 by Jones & Bartlett Learning, LLC, an Ascend Learning Company. All rights reserved.

www.jblearning.com Instructor Lab Manual

44 | LAB #5 Identifying Risks, Threats, and Vulnerabilities in an IT Infrastructure

Using Zenmap® GUI (Nmap) and Nessus® Reports

Over the past 15 years, the features available in Nmap have multiplied several times. The ability to craft packets down to specific flags and options can make troubleshooting—and disrupting—networked devices almost limitless. The people and companies tasked with protecting against hackers must play a game of cat and mouse against the growing set of options in tools such as Nmap. Innovation and open source allows this game to be played indefinitely.

5. Review the Lab 5 Nessus Vulnerability Scan Report that accompanies this lab.

6. Using the Lab 5 Nessus Vulnerability Scan Report, answer the following questions:

 How many hosts were scanned?

 What were the start and end times for each of the scans?

 How many total vulnerabilities were discovered for each host?

 How many of the vulnerabilities were critical, major, and minor software vulnerabilities?

Note:

Nessus is a powerful vulnerability scanner, with a fast-growing list of available plug-ins. As a vulnerability scanner, the tool scans the networked devices for potential weaknesses and exploitable services. As you see from the lab sample, reporting can be detailed and customized. While still free for personal, home use, Nessus is also available for commercial use with an annual subscription fee.

Nessus can be installed and run fairly easily, but here are a few tips that will produce much more benefit. First, update the plug-ins on install. By default, Nessus will update plug-ins once a day. Another tip is to use Nessus as a compliance tool. While it is by nature a vulnerability tool, one Nessus feature is to load a configuration file (called an audit file by Nessus) and then scan with Nessus to verify compliance against your end devices.

7. On your local computer, open a new Internet browser window.

8. In the address box of your Internet browser, type the URL http://cve.mitre.org and press

Enter to open the Web site.

9. On the Web site, toward the top left of the screen, click the CVE List link.

10. Review the CVE List Main Page.

11. Define CVE.

12. On the right, under Items of Interest, click the Terminology link.

13. Review the definitions for vulnerability and exposure.

14. Define the terms vulnerability and exposure.

15. At the top right of the Web site, click the Search link.

45

16. In the Search box, type the words Microsoft® XP 2003 Service Pack 1 and click the Search button.

17. Describe some of the results you discover.

18. After viewing the results, conduct another search and this time, type the words Cisco ASA

5505 Security + and click the Search button.

19. Describe some of the search results.

Note:

This completes the lab. Close the Web browser, if you have not already done so.

Copyright © 2015 by Jones & Bartlett Learning, LLC, an Ascend Learning Company. All rights reserved.

www.jblearning.com Instructor Lab Manual

Homework is Completed By:

Writer Writer Name Amount Client Comments & Rating
Instant Homework Helper

ONLINE

Instant Homework Helper

$36

She helped me in last minute in a very reasonable price. She is a lifesaver, I got A+ grade in my homework, I will surely hire her again for my next assignments, Thumbs Up!

Order & Get This Solution Within 3 Hours in $25/Page

Custom Original Solution And Get A+ Grades

  • 100% Plagiarism Free
  • Proper APA/MLA/Harvard Referencing
  • Delivery in 3 Hours After Placing Order
  • Free Turnitin Report
  • Unlimited Revisions
  • Privacy Guaranteed

Order & Get This Solution Within 6 Hours in $20/Page

Custom Original Solution And Get A+ Grades

  • 100% Plagiarism Free
  • Proper APA/MLA/Harvard Referencing
  • Delivery in 6 Hours After Placing Order
  • Free Turnitin Report
  • Unlimited Revisions
  • Privacy Guaranteed

Order & Get This Solution Within 12 Hours in $15/Page

Custom Original Solution And Get A+ Grades

  • 100% Plagiarism Free
  • Proper APA/MLA/Harvard Referencing
  • Delivery in 12 Hours After Placing Order
  • Free Turnitin Report
  • Unlimited Revisions
  • Privacy Guaranteed

6 writers have sent their proposals to do this homework:

Innovative Writer
Quick N Quality
Assignment Hub
Engineering Mentor
Coursework Helper
Top Academic Tutor
Writer Writer Name Offer Chat
Innovative Writer

ONLINE

Innovative Writer

After reading your project details, I feel myself as the best option for you to fulfill this project with 100 percent perfection.

$20 Chat With Writer
Quick N Quality

ONLINE

Quick N Quality

Being a Ph.D. in the Business field, I have been doing academic writing for the past 7 years and have a good command over writing research papers, essay, dissertations and all kinds of academic writing and proofreading.

$31 Chat With Writer
Assignment Hub

ONLINE

Assignment Hub

I have read your project details and I can provide you QUALITY WORK within your given timeline and budget.

$40 Chat With Writer
Engineering Mentor

ONLINE

Engineering Mentor

I find your project quite stimulating and related to my profession. I can surely contribute you with your project.

$40 Chat With Writer
Coursework Helper

ONLINE

Coursework Helper

As per my knowledge I can assist you in writing a perfect Planning, Marketing Research, Business Pitches, Business Proposals, Business Feasibility Reports and Content within your given deadline and budget.

$39 Chat With Writer
Top Academic Tutor

ONLINE

Top Academic Tutor

I am a professional and experienced writer and I have written research reports, proposals, essays, thesis and dissertations on a variety of topics.

$30 Chat With Writer

Let our expert academic writers to help you in achieving a+ grades in your homework, assignment, quiz or exam.

Similar Homework Questions

Brannon company manufactures ceiling fans and uses an activity - Hesta address and abn - What are the four main branches of earth science - Ebonite optyx skull bowling ball - Exhaust gas analysis by orsat apparatus - 58.9 kg in stones and pounds - Theatre - Qbo intuit com sample company - Nutrition real people real choices pdf - Nova rise of the superstorms video questions answer key - Jdsu hst 3000 t1 testing - Time transfixed analysis - Chapter 1 the business and society relationship - Wrigley a subsidiary of mars incorporated - Synthesis of nylon 6 6 lab report - If vickers company issues 4,000 shares of $5 par value common stock for $140,000, - Guillermo bonfil mexico profundo pdf - Evs worksheet for class 2 - Bill gates characteristics as an entrepreneur - Assume that denis savard inc. has the following accounts at the end of the current year. - Kara saunders she bear shirt - Externalizing the problem worksheets - Why we use phenolphthalein as indicator - Math - Ib economics hl weighting - Different types of management accounting systems - Indirect connection to public sewer - Advantages and disadvantages of computer forensics - MBA - Main - Set 15 - Persuasive Speech Outline - Birchstreet systems login hilton - Items produced by a manufacturing process - Company of heroes failed to create dump file error 183 - CCM - Sample script for debut - Hannah watts park melton vic - Http www fbi gov wanted wanted_terrorists - Explain the difference between implicit biases and stereotypes - Nancy mairs on being a cripple questions - Courier service database design - Assessment - Gymea gorillas tag league - Question - Best practices in healthcare facilities capital planning - The ethics of teaching strike and soltis chapter summaries - Astm g93 level a - Icd 10 status post motor vehicle accident - Hero forge steel mini review - The equation which reflects a cvp income statement is - L&d nail supply west palm beach - Hcf cash back cover - Green vitae essence nutrition facts - How to write a sonnet for dummies - 2pages with out references no plagiarism - How is energy stored in a plant - Pearson vue - gbr - Conductors and insulators and semiconductors - What is the name of h3o - Recruit select and induct staff assessment answers - PHYS - Upside of irrationality pdf - Lamarck vs darwin giraffe - Mitosis and meiosis lab 5 answers - Adónde 1 ustedes de vacaciones - How to convert rotary motion into reciprocating motion - Inside intel inside case study solution - A sentimental journey through france and italy sparknotes - 3 year old child observation report pdf - Ethical issues in interpersonal communication - Asset beta to equity beta - Give me liberty eric foner volume 2 3rd edition ebook - Samra travel agent walsall - Grand chase rufus 4th job - Ford motor company case study analysis - Essbase report script level 0 - Deliverable 1 - Kingston-Bryce Kick-off Project Plan - Reviewing an Econ 101 assignment - How venture capitalists evaluate potential opportunities - Dialogic theory of public speaking - Mini paper on given topic - Project - Accountable care organizations vs managed care - National grid transformer specification - Visual basic questions and answers pdf - De morgan's law statement - TEAM MANAGEMENT assignment 1 - How do you spell sandcastle - Intervention planning - Taeass502 assessment examples - How to calculate expected payoff - C.josef lamy gmbh 69111 heidelberg - Bluetooth battery monitor jaycar - Measuring the speed of light using a microwave - 500 word essay APA style - Group counseling course with Zoom - Discussion - Secondary activities in value chain - Types of simple machines - Multiple sclerosis nursing concept map - Gold coast city council offices