Skip to content

Bikash-Raya/Nessus-Vulnerability-Management-Lab

BranchesTags

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

11 Commits
Nessus_Vulnerability_Management_Lab_Report.pdf
Nessus_Vulnerability_Management_Lab_Report.pdf
 
 
README.md
README.md
 
 

Repository files navigation

🛡️ Nessus Vulnerability Management Lab – Credentialed Scanning, GPO Deployment & Remediation

Domain Infrastructure Platform

Prepared by: Bikash Raya

📁 Full Lab Walkthrough — Proof of Work

File Description
Nessus_Vulnerability_Management_Lab_Report.pdf Hands-on lab walkthrough with screenshots

📋 Overview

This repository documents a hands-on enterprise vulnerability management lab built using Tenable Nessus Essentials 10.12.0 on Kali Linux, targeting a VMware-hosted Active Directory environment (biksec.com domain).

The lab simulates a real-world SOC/vulnerability management workflow including:

  • 🔐 Creating a dedicated Active Directory service account (SVC_Nessus) for credentialed scanning
  • 🛠️ Installing and configuring Tenable Nessus Essentials 10.12.0 on Kali Linux
  • 📋 Building a reusable scan policy (SecOps Default Scan) with Windows domain credentials
  • 🗂️ Organising scans into External Facing (daily) and Internal Facing (weekly) folders
  • 🧩 Deploying two Group Policy Objects to enable scanning prerequisites across all domain machines
  • ✅ Executing credentialed vulnerability scans and validating authentication success
  • 🔧 Remediating SMB Signing misconfiguration via GPO and upgrading outdated 7-Zip
  • 🌐 Conducting a web application vulnerability scan against testasp.vulnweb.com (18 findings)
  • 🔍 Troubleshooting real-world issues including VMware NAT routing and Windows auth failures

🛠️ Technologies Used

  • Tenable Nessus Essentials 10.12.0
  • Kali Linux (BIKSEC-LINUX)
  • VMware Workstation
  • Windows Server (Active Directory — biksec.com domain)
  • Windows Server 2022 (BIKSEC-WEB01)
  • Windows 11 (BIKSEC-WIN11)
  • Group Policy Management (GPMC)
  • Windows Management Instrumentation (WMI)
  • PowerShell
  • Nmap
  • SMB Protocol & Signing
  • 7-Zip (CVE remediation)

🧪 Lab Components

System Role IP Address Hosting
BIKSEC-LINUX Kali Linux — Nessus Scanner 192.168.49.50 VMware Workstation
BIKSEC-DC01 Windows Server — Domain Controller 192.168.49.10 VMware Workstation
BIKSEC-WEB01 Windows Server 2022 — Web Server 192.168.49.20 VMware Workstation
BIKSEC-WIN11 Windows 11 — Workstation 192.168.49.40 VMware Workstation
testasp.vulnweb.com ASP.NET Web App — Scan Target 44.238.29.244 External (Acunetix)

🌐 Solution Architecture

[Kali Linux — Nessus Essentials 10.12.0]
          ↓
[Credentialed Scan Policy — SVC_Nessus / biksec.com]
          ↓
    ┌─────────────────────────────┐
    │     VMware NAT Network      │
    │     192.168.49.0/24         │
    ├─────────────┬───────────────┤
    │             │               │
[DC01]       [WEB01]         [WIN11]
192.168.49.10  192.168.49.20  192.168.49.40
    │
[Active Directory — biksec.com]
    │
[GPO: Nessus Scanning Pre Req]  → Enables WMI, Remote Registry, File & Printer Sharing
[GPO: SMB Signing Hardening]    → Enforces SMB message signing
          ↓
[Nessus Alerts → Vulnerability Analysis → Remediation → Rescan Validation]
          ↓
[Web App Scan → testasp.vulnweb.com → 18 Findings]

🔐 Phase 1 — Active Directory Service Account Setup

A dedicated service account was created on BIKSEC-DC01 to allow Nessus to perform authenticated scans:

Property Value
Account Name SVC_Nessus
Logon Name SVC_Nessus@biksec.com
Domain biksec.com
Group Membership Domain Admins
Purpose Nessus credentialed scan service account

🖥️ Phase 2 — Nessus Installation on Kali Linux

Fix network routing (VMware NAT — no default gateway on startup):

sudo ip route add default via 192.168.49.2
sudo systemctl start nessusd

Note: Run these after every Kali VM restart to restore internet access.

Download and install Nessus:

cd ~/Downloads
ls    # Nessus-10.12.0-ubuntu1604_amd64.deb
sudo dpkg -i Nessus-10.12.0-ubuntu1604_amd64.deb

Start and verify the Nessus service:

/bin/systemctl start nessusd.service
systemctl status nessusd.service

✅ Service confirmed active (running) — PID 17438, Memory 212.6M

Access Nessus UI:

https://localhost:8834

Select Nessus Essentials → Register at tenable.com for free activation code

📋 Phase 3 — Scan Policy Configuration

SecOps Default Scan Policy

Setting Value
Policy Name SecOps Default Scan
Template Basic Network Scan
Auth Method Windows — Password
Username SVC_Nessus
Domain biksec.com
NTLM Disabled (security best practice)
Report Designate hosts by DNS name

Scan Folders & Schedules

Folder Targets Schedule
External Facing BIKSEC-WEB01 (192.168.49.20) Daily at 2:00 PM
Internal Facing BIKSEC-DC01 + BIKSEC-WIN11 Weekly (manually triggered in trial)

Note: Nessus Essentials trial limits scheduling to one active schedule. Internal scan was manually triggered for lab purposes.

🧩 Phase 4 — GPO Deployment: Nessus Scanning Pre Req

To enable credentialed scanning across all domain endpoints, a GPO was deployed from BIKSEC-DC01:

Services Enabled via GPO

Service / Rule GPO Path Startup Type
Remote Registry Computer Config > Policies > Windows Settings > Security Settings > System Services Automatic
Windows Management Instrumentation (WMI) Computer Config > Policies > Windows Settings > Security Settings > System Services Automatic
WMI Firewall Inbound Rule WD Firewall with Advanced Security > Inbound Rules Predefined — WMI-In
File and Printer Sharing WD Firewall with Advanced Security > Inbound Rules Enabled

Apply GPO immediately:

gpupdate /force

✅ Output: Computer Policy update has completed successfully.

Verify GPO application:

gpresult /r /scope computer

✅ Applied Group Policy Objects: Nessus Scanning Pre Req confirmed

🔍 Vulnerability Findings — Internal VMs

WEB01 (192.168.49.20) — Key Findings

Finding Severity Plugin ID CVSS
SMB Signing Not Required 🟠 Medium 57608 5.3
7-Zip < 24.01 Heap-based Buffer Overflow 🔴 Critical — 9.4
7-Zip < 18.05 Memory Corruption 🔴 High — 7.8
7-Zip < 23.00 Multiple Vulnerabilities 🔴 High — 7.8
7-Zip < 24.07 RCE (ZDI-24-1556) 🔴 High — 7.8
Microsoft Azure Stack Hub (Multiple Issues) 🔴 Critical — —
Microsoft Windows Server 2022 (Multiple Issues) 🔴 High — —

🔧 Phase 5 — Vulnerability Remediation

Remediation 1: SMB Signing Hardening (GPO)

A new GPO "SMB Signing Hardening" was created and linked to the Servers OU:

Computer Config > Policies > Windows Settings > Security Settings
> Local Policies > Security Options
Setting Value
Microsoft network server: Digitally sign communications (always) Enabled
Microsoft network client: Digitally sign communications (always) Enabled

Verification via PowerShell on BIKSEC-WEB01:

Get-SmbServerConfiguration | Select EnableSecuritySignature, RequireSecuritySignature

✅ Output: RequireSecuritySignature = True — SMB signing now enforced

Remediation 2: 7-Zip Upgrade

  • Identified: 7-Zip version 26.1.0.0 with multiple Critical/High CVEs
  • Action: Downloaded and installed latest stable 7-Zip from https://www.7-zip.org
  • Nessus Remediation tab confirmed: 7-Zip >= 25.01: Upgrade to 7-Zip version 25.01 or later

🌐 Web Application Scan — testasp.vulnweb.com

Network Troubleshooting — Invalid Target Error

During the initial web app scan, Nessus reported:

"Invalid Target — testasp.vulnweb.com was not scanned because IP address resolution failed"

Root Cause: No default gateway on Kali VM — DNS resolution unavailable.

Fix Applied:

sudo ip route add default via 192.168.49.2 dev eth0

Verified:

nslookup testasp.vulnweb.com   # Resolved to 44.238.29.244
ping testasp.vulnweb.com -c 4  # 4/4 packets, 0% packet loss

Web App Scan Results — 18 Vulnerabilities Found

Vulnerability Severity CVSS Family
CGI Generic Path Traversal 🟠 Medium 5.3 CGI abuses
CGI Generic Cookie Injection Scripting 🟠 Medium 4.3* CGI abuses
CGI Generic HTML Injections 🟠 Medium 4.3* CGI abuses: XSS
CGI Generic XSS (quick test) 🟠 Medium 4.3* CGI abuses: XSS
Web App Potentially Vulnerable to Clickjacking 🟠 Medium 4.3* Web Servers
Web Server (Multiple Issues) ℹ️ Info — Web Servers
HTTP (Multiple Issues) ℹ️ Info — CGI abuses
Nessus SYN Scanner ℹ️ Info — Port scanners
CGI Generic Injectable Parameter ℹ️ Info — CGI abuses

Key Finding: CGI Generic Path Traversal (Plugin 39467)

Affected Endpoint:  /Templatize.asp
Parameter:          item (GET)
Proof of Concept:   /Templatize.asp?item=../../../../../../../../windows/win.ini
Evidence:           Server returned contents of windows/win.ini — [fonts], [extensions]
CVSS v3.0:          5.3  (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
CWE:                CWE-22 (Path Traversal) | OWASP-AZ-001

🛡️ Troubleshooting & Issues Resolved

Issue Root Cause Resolution
Kali no internet after restart VMware NAT — no default gateway sudo ip route add default via 192.168.49.2
Nessus service failed to start systemctl path issue Use /bin/systemctl start nessusd.service
WIN11 credential scan failed WMI / Remote Registry / File Sharing not enabled Enabled manually; deployed Nessus Scanning Pre Req GPO
testasp.vulnweb.com Invalid Target No default gateway — DNS resolution failed Added default route; verified with nslookup and ping
Trial allows only one schedule Nessus Essentials limitation Internal scan configured weekly but triggered manually

🎯 Skills Demonstrated

  • Tenable Nessus Essentials Configuration & Credentialed Scanning
  • Active Directory Service Account Creation & Management
  • Group Policy Object (GPO) Design and Deployment
  • SMB Signing Hardening via GPO (Security Options)
  • Windows Services & Firewall Configuration for Remote Scanning
  • Vulnerability Identification, Analysis & Risk Prioritisation
  • Vulnerability Remediation (GPO enforcement + software patching)
  • Network Troubleshooting (VMware NAT, routing, DNS)
  • Nmap Port Verification
  • PowerShell Security Configuration Validation
  • Web Application Vulnerability Scanning (Nessus Web App Tests)
  • Linux CLI & Network Administration
  • VMware Multi-VM Lab Design
  • Professional Vulnerability Management Report Writing

🎯 Key Takeaway

This project demonstrates practical, hands-on experience in enterprise vulnerability management using Tenable Nessus Essentials — covering the full lifecycle from Active Directory service account creation and GPO-based endpoint preparation, through credentialed scanning, vulnerability identification, GPO remediation (SMB Signing Hardening), software patching (7-Zip), and rescan validation. A secondary web application scan confirmed real-world vulnerabilities including CGI Path Traversal with working proof-of-concept output. All troubleshooting steps including VMware NAT routing issues and Windows authentication failures are fully documented with screenshots.

🔗 Related Projects

Part of the Bikash Security Lab series:

📄 Thanks for reading! For a full hands-on walkthrough of this lab with screenshots — download the lab report here

🔗 Connect With Me

LinkedIn GitHub

⭐ If you find this project useful, feel free to star the repository ⭐

About

No description, website, or topics provided.

Resources

Readme
Activity

Stars

0 stars

Watchers

0 watching

Forks

0 forks
Report repository

Releases

No releases published

Packages

 
 
 

Contributors