{"id":130234,"date":"2009-12-08T09:58:00","date_gmt":"2009-12-08T14:58:00","guid":{"rendered":"tag:blogger.com,1999:blog-7196788127833928948.post-6670860071910724984"},"modified":"2009-12-08T09:58:00","modified_gmt":"2009-12-08T14:58:00","slug":"nexpose-community-edition-our-first-look","status":"publish","type":"post","link":"https:\/\/mereja.media\/index\/130234","title":{"rendered":"NeXpose Community Edition &#8211; Our First Look"},"content":{"rendered":"<p>Rapid7 chose to publish a<a href=\"http:\/\/community.rapid7.com\/redmine\/projects\/nexpose\/wiki\"> free version of their <span class=\"blsp-spelling-error\" id=\"SPELLING_ERROR_0\">NeXpose<\/span> scanner<\/a><span style=\"font-weight: bold;\">. <\/span>The software is available for less then a month, and still has to prove itself to the general community. We are publishing the experiences of our first look on this product. The <span class=\"blsp-spelling-error\" id=\"SPELLING_ERROR_1\">NeXpose<\/span> Community integrates with <span class=\"blsp-spelling-error\" id=\"SPELLING_ERROR_2\">Metasploit<\/span>, and the integration will be covered in the next article.<\/p>\n<p><a onblur=\"try {parent.deselectBloggerImageGracefully();} catch(e) {}\" href=\"http:\/\/1.bp.blogspot.com\/_Hu1rpxRsqcU\/Sx6dGlhSPPI\/AAAAAAAAAas\/GtGdYQG_JU0\/s1600-h\/Nexpose_Community.jpg\"><img decoding=\"async\" style=\"margin: 0px auto 10px; display: block; text-align: center; cursor: pointer; width: 320px; height: 194px;\" src=\"http:\/\/1.bp.blogspot.com\/_Hu1rpxRsqcU\/Sx6dGlhSPPI\/AAAAAAAAAas\/GtGdYQG_JU0\/s320\/Nexpose_Community.jpg\" alt=\"\" id=\"BLOGGER_PHOTO_ID_5412936538622409970\" border=\"0\" \/><\/a><br \/><span style=\"font-weight: bold;\">Installation<\/span> The installation is simple enough &#8211; just run the installer. It asks for a <span class=\"blsp-spelling-error\" id=\"SPELLING_ERROR_3\">username<\/span>\/password for the web interface, and then installs itself. There are no errors when installing on Windows 7, <span class=\"blsp-spelling-error\" id=\"SPELLING_ERROR_4\">XP<\/span> SP3 and Win2003 Server.<\/p>\n<p><span style=\"font-weight: bold;\">First run<\/span><br \/>Start up on Windows 7 was not successful. <span class=\"blsp-spelling-error\" id=\"SPELLING_ERROR_5\">NeXpose<\/span> Community just threw a lot of access denied error messages. As far as i could understand, the access denied messages are because of an attempt to modify the registry which is protected under Windows 7. Even when using Run As Administrator i got the same results.<br \/>The run was successful from the Windows2003 server installation. The first <span class=\"blsp-spelling-corrected\" id=\"SPELLING_ERROR_6\">start up<\/span> was extremely slow, it ran for more then 15 minutes configuring and updating itself. After that, the web interface is available for <span class=\"blsp-spelling-error\" id=\"SPELLING_ERROR_7\">login<\/span> at https:\/\/serverip:3780<\/p>\n<p><span style=\"font-weight: bold;\">First Scan<\/span><br \/>In order to scan you need to configure a Site, with target <span class=\"blsp-spelling-error\" id=\"SPELLING_ERROR_8\">IP&#8217;s<\/span> within it. You can add several target <span class=\"blsp-spelling-error\" id=\"SPELLING_ERROR_9\">IP&#8217;s<\/span> within the same site. The scanning options include the following scanning templates:<\/p>\n<ul>\n<li><span style=\"font-weight: bold;\">Full audit<\/span> : Performs a full network audit of all systems using only safe checks, including network-based vulnerabilities, patch\/<span class=\"blsp-spelling-error\" id=\"SPELLING_ERROR_10\">hotfix<\/span> checking, and application-layer auditing. Only default ports are scanned, and policy checking is disabled, making this faster than the Exhaustive scan.<\/li>\n<\/ul>\n<ul>\n<li><span style=\"font-weight: bold;\">Exhaustive <\/span>: Performs an exhaustive network audit of all systems and services using only safe checks, including patch\/<span class=\"blsp-spelling-error\" id=\"SPELLING_ERROR_11\">hotfix<\/span> checking, policy compliance checking, and application-layer auditing. Performing an exhaustive audit could take several hours or even days to complete, depending on the number of hosts selected.<\/li>\n<\/ul>\n<ul>\n<li><span style=\"font-weight: bold;\">Penetration test <\/span>: Performs an in-depth penetration test of all systems using only safe checks. Host-discovery and network penetration options will be enabled, allowing <span class=\"blsp-spelling-error\" id=\"SPELLING_ERROR_12\">NeXpose<\/span> to dynamically discover additional systems in your network to target. In-depth patch\/<span class=\"blsp-spelling-error\" id=\"SPELLING_ERROR_13\">hotfix<\/span> checking, policy compliance checking, and application-layer auditing will not be performed.<span style=\"font-weight: bold;\"><\/span><\/li>\n<\/ul>\n<p>These templates and their behaviour cannot be modified in the <span class=\"blsp-spelling-error\" id=\"SPELLING_ERROR_14\">NeXpose<\/span> Community.<\/p>\n<p><strong><\/strong><em><\/em>You can run the scan at scheduled intervals as well as manually. Once you initiate the scan, the scanning engine is very fast, and usually completes Penetration Test scan within 5-7 minutes on a fast link.<\/p>\n<p><span style=\"font-weight: bold;\">Scan Results<\/span><br \/>The scan results are presented in a very clear manner, for each site separately. The Penetration Test template on a Damn Vulnerable Linux 1.5 with active HTTP target was scanned in less then 3 minutes, and identified the following vulnerabilities<\/p>\n<ul>\n<li><span class=\"blsp-spelling-error\" id=\"SPELLING_ERROR_15\">PHP<\/span> Multiple Vulnerabilities Fixed in version 4.4.9<\/li>\n<li><span class=\"blsp-spelling-error\" id=\"SPELLING_ERROR_16\">PHP<\/span> Unspecified &#8216;glob&#8217; Vulnerability<\/li>\n<li><span class=\"blsp-spelling-error\" id=\"SPELLING_ERROR_17\">PHP<\/span> Crafted <span class=\"blsp-spelling-error\" id=\"SPELLING_ERROR_18\">UTF<\/span>-8 Inputs Buffer Overflow<\/li>\n<li>Apache Signals Sent to Arbitrary Processes Denial of Service<\/li>\n<li><span class=\"blsp-spelling-error\" id=\"SPELLING_ERROR_19\">PHP<\/span> session.save_path\/error_log Values Not Checked Against open_<span class=\"blsp-spelling-error\" id=\"SPELLING_ERROR_20\">basedir<\/span> and safe_mode<\/li>\n<li>Apache mod_<span class=\"blsp-spelling-error\" id=\"SPELLING_ERROR_21\">imap<\/span>\/mod_<span class=\"blsp-spelling-error\" id=\"SPELLING_ERROR_22\">imagemap<\/span> Cross-Site Scripting Vulnerability in <span class=\"blsp-spelling-error\" id=\"SPELLING_ERROR_23\">imagemap<\/span> File Menus<\/li>\n<li>HTTP TRACE Method Enabled<\/li>\n<li><span class=\"blsp-spelling-error\" id=\"SPELLING_ERROR_24\">ICMP<\/span> timestamp response<\/li>\n<\/ul>\n<p>The reporting, although crippled compared to the commercial versions of <span class=\"blsp-spelling-error\" id=\"SPELLING_ERROR_25\">NeXpose<\/span> is still very good. You can schedule report generation and sending, and you can configure a baseline for each report &#8211; you get comparative results of the changes between the scans. This is very useful for automated scanning and information required by IT Auditors and Information Security Officers.<\/p>\n<p><span style=\"font-weight: bold;\">Conclusions<\/span><br \/><span class=\"blsp-spelling-error\" id=\"SPELLING_ERROR_26\">NeXpose<\/span> Community is a valuable addition to the free tools that each security professional can use in his\/hers work. It is very useful in terms of automated audits, and very interesting that it integrates with the <span class=\"blsp-spelling-error\" id=\"SPELLING_ERROR_27\">Metasploit<\/span> Exploit Framework. It still has glitches and issues on some platforms, but all tools are work in progress, so for the time being just add it to your <span class=\"blsp-spelling-error\" id=\"SPELLING_ERROR_28\">toolset<\/span>, don&#8217;t replace any tools with it.<\/p>\n<p><span class=\"blsp-spelling-error\" id=\"SPELLING_ERROR_29\">Talkback<\/span> and comments are most welcome<\/p>\n<p>Related posts<br \/><a href=\"http:\/\/www.shortinfosec.net\/2009\/12\/possible-emerging-player-in-infosec.html\">Possible Emerging Player In <span class=\"blsp-spelling-error\" id=\"SPELLING_ERROR_30\">InfoSec<\/span> Market?<\/a><br \/><a href=\"http:\/\/www.shortinfosec.net\/2009\/10\/vulnerability-scanning-tools-evaluation.html\"><span class=\"blsp-spelling-error\" id=\"SPELLING_ERROR_31\">Nessus<\/span> vs Retina &#8211; Vulnerability Scanning Tools Evaluation<\/a><br \/><a href=\"http:\/\/www.shortinfosec.net\/2008\/07\/tutorial-using-ratproxy-for-analysis.html\">Tutorial &#8211; Using <span class=\"blsp-spelling-error\" id=\"SPELLING_ERROR_32\">Ratproxy<\/span> for Web Site Vulnerability Analysis<\/a><br \/><a href=\"http:\/\/www.shortinfosec.net\/2008\/12\/wmi-scanning-excellent-security-tool.html\"><span class=\"blsp-spelling-error\" id=\"SPELLING_ERROR_33\">WMI<\/span> Scanning &#8211; Excellent Security Tool<\/a><\/p>\n<div class=\"blogger-post-footer\"><img width='1' height='1' src='https:\/\/blogger.googleusercontent.com\/tracker\/7196788127833928948-6670860071910724984?l=www.shortinfosec.net' alt='' \/><\/div>\n<p><img loading=\"lazy\" decoding=\"async\" src=\"http:\/\/feeds.feedburner.com\/~r\/shortinfosec\/~4\/kDJOfPAoa8w\" height=\"1\" width=\"1\"\/><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Rapid7 chose to publish a free version of their NeXpose scanner. The software is available for less then a month, and still has to prove itself to the general community. We are publishing the experiences of our first look on this product. The NeXpose Community integrates with Metasploit, and the integration will be covered in [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7],"tags":[],"class_list":["post-130234","post","type-post","status-publish","format-standard","hentry","category-news"],"_links":{"self":[{"href":"https:\/\/mereja.media\/index\/wp-json\/wp\/v2\/posts\/130234","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mereja.media\/index\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mereja.media\/index\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mereja.media\/index\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mereja.media\/index\/wp-json\/wp\/v2\/comments?post=130234"}],"version-history":[{"count":0,"href":"https:\/\/mereja.media\/index\/wp-json\/wp\/v2\/posts\/130234\/revisions"}],"wp:attachment":[{"href":"https:\/\/mereja.media\/index\/wp-json\/wp\/v2\/media?parent=130234"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mereja.media\/index\/wp-json\/wp\/v2\/categories?post=130234"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mereja.media\/index\/wp-json\/wp\/v2\/tags?post=130234"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}