Instructor: In this lecture, 2 2
I'd like to talk about the tool called Nexpose. 3 3
Nexpose is made by Rapid7. 4 4
So it's made by the same people 5 5
that made Metasploit and Metasploit Community. 6 6
And it's similar to Metasploit Community 7 7
in a sense that it has a web GUI 8 8
and it allow us to discover, assess 9 9
and act on discovered vulnerabilities. 10 10
It also maps these vulnerabilities to existing exploits. 11 11
But the difference is Metasploit Community on showed us 12 12
exploits that can be used within Metasploit. 13 13
Whereas with Nexpose, it actually show us exploits 14 14
that have been published somewhere else 15 15
other than Rapid7 and Metasploit. 16 16
So it works on a larger scale. 17 17
It shows us more vulnerabilities. 18 18
And it also help us to create a report 19 19
at the end of the scan, 20 20
so that we can share it with the technical people 21 21
and smaller report which is of a high level 22 22
that can be shared with the managers. 23 23
It also help us create a scheduled scans, 24 24
so that, for example, if you have a company 25 25
or if you're working on a big infrastructure, 26 26
and you want to do regular scans every week or every month, 27 27
then you can do that using this tool. 28 28
Let me show you how to install it and run it, 29 29
and the differences will become more clear. 30 30
So Nexpose doesn't come in installed in Kali Linux, 31 31
we have to install it manually. 32 32
To download it, you need to download it 33 33
from the following link. 34 34
It'll ask you to fill up your name and address and all that, 35 35
fill it up and download. 36 36
I downloaded the community version, which is free. 37 37
So I have it right here. 38 38
Now what I'm going to do before we can install it, 39 39
the first thing we're going to do 40 40
is stop the PostgreSQL service that comes in installed with, 41 41
or that is running in Kali Linux. 42 42
So I'm gonna do service, 43 43
post 44 44
stop, that will stop the service, the SQL service. 45 45
Now, I'm actually already at the Downloads folder. 46 46
So usually when you run your Terminator, you will be here. 47 47
So if you do an ls, you'll see all the directories 48 48
and you'll need to change your directory 49 49
to the Downloads directory by using the cd command. 50 50
So cd and type in Downloads. 51 51
Now once we're in the Downloads, 52 52
we can list all the available files. 53 53
And we can see that we have Nexpose right here. 54 54
Now usually, you'll have this, 55 55
you'll need to change the permissions of this 56 56
to an executable, 57 57
I've already changed it, that's why it's in green. 58 58
So for you for the first time, 59 59
you need to run a command, the chmod command, 60 60
to change the permissions so that we can execute that file. 61 61
So the command will be chmod 62 62
plus x, and you type in the file name 63 63
that you want to change the permission. 64 64
And for us it's Nexpose. 65 65
And that's it, the permissions are changed. 66 66
Now to run this installer, 67 67
to run any executable in Linux systems, 68 68
all you have to do is dot and forward slash, 69 69
then type the file that you wanna run. 70 70
So for us it's Nexpose. 71 71
Now as you can see, you get a nice installer for it. 72 72
So I'm gonna click Next. 73 73
Now it's asking me to accept the agreement. 74 74
And I'm gonna install the console with the scan engine. 75 75
Now as you can see, one of the problems that I have here 76 76
is that it's not supported 77 77
with the Kali Linux version that I have. 78 78
I have the latest Rolling version of Kali Linux, 79 79
and Nexpose is not compatible with it, 80 80
so it's not gonna let me install it. 81 81
Now it's only compatible with Kali 2. 82 82
So, if we want to proceed and go ahead with this, 83 83
we're going to modify two files on our local system 84 84
to make our system look like Kali 2, 85 85
so that the installer will let us install it on our system. 86 86
Now hopefully in your case, 87 87
by the time you watch this video, 88 88
there will be a supported version. 89 89
So you can just click Next in this step. 90 90
But for me, I'm gonna have to go in 91 91
and modify two files to make my system look like Kali 2. 92 92
So follow the steps that I'm gonna do now, 93 93
only if you get this error. 94 94
So I clicked on Finish, and I'm gonna go here, 95 95
I'm gonna attach a file that contains the instructions 96 96
that you need to do to fill 97 97
or to change the version of your system to Kali 2. 98 98
So I have it here in the documents. 99 99
The two files that need to be changed 100 100
are the lsb-release and the os-release. 101 101
So I'm going to open two tabs in here, one for each file. 102 102
And the first one is in etc, 103 103
And it's called lsb-release, and we can see the file here. 104 104
Now before I modify this file, 105 105
I'm actually gonna copy it and store a backup of it. 106 106
Because after we finished this step, 107 107
I'm gonna restore it to the way it was. 108 108
So I'm gonna create a new folder 109 109
and I'm gonna call it backup. 110 110
And I'll paste this file here. 111 111
And after I do that, I'm gonna modify the file 112 112
according to the instructions. 113 113
So I'm gonna open it with Leafpad. 114 114
And I'm gonna copy all of this, 115 115
I'm gonna save it, 116 116
and quit it. 117 117
I'm gonna do the same with the next file, 118 118
which is the os-releases, 119 119
which is stored in User os-releases. 120 120
So I'm gonna copy this and put it in my backup. 121 121
Then I'm gonna modify it according to the instructions. 122 122
Okay, now everything is done. 123 123
I'm going to go back and run the installer again. 124 124
And it should think that I have Kali 2 installed 125 125
and let me proceed through the installation. 126 126
So again, scroll down, Accept, Next. 127 127
And as you can see that it thinks I have Kali 2, 128 128
so it's letting me proceed through the installation. 129 129
Now I'm gonna put my name, my last name and the company. 130 130
And now it's asking me to put the port 131 131
for the database that's going to be used with Nexpose. 132 132
Now that port is already being used 133 133
with an already installed database. 134 134
So I'm gonna make the port 5435. 135 135
And as you can see, it's telling me 136 136
that the port is valid and can be used. 137 137
So I'm gonna go next. 138 138
Now it's asking me to make a username 139 139
and a password for login. 140 140
So I'm gonna make a username and call it zaid, 141 141
and then I'm gonna select my password. 142 142
And make sure you don't check this box. 143 143
Now, I had a lot of issues 144 144
when I was checking this box while installation, 145 145
which basically should start Nexpose 146 146
once the installation is over. 147 147
But I'm not gonna check it. 148 148
I'm just gonna install it and then start it later 149 149
when we want to use it. 150 150
So I'm not gonna check this box, make sure it's unchecked. 151 151
And that's it. 152 152
Now it's going to install it for me. 153 153
I'm gonna pause 154 154
and resume once the installation is complete. 155 155
Okay, so the installation is successful. 156 156
And we didn't start Nexpose yet. 157 157
So if you go on this link, nothing's gonna work. 158 158
You need to run this command first, 159 159
and then you can access it. 160 160
So we're gonna talk about that in the next lecture. 161 161
For now, that's it. 162 162
I'm gonna click on Finish, and we're done. 163 163
Now, 164 164
we're gonna go back and make sure 165 165
we set our files back to the way they were. 166 166
Now if you didn't need to modify them, 167 167
then again, skip this step. 168 168
If you did modify them, like myself, 169 169
then make sure you go back 170 170
and you set them back to the way they were. 171 171
So I'm gonna go on my backup, 172 172
and I'm gonna open these files. 173 173
So we're gonna do the os-release first. 174 174
I'm gonna copy it, 175 175
and modify the existing one, and make sure it's the same 176 176
as it used to be the, Rolling one. 177 177
As you can see, it says Kali 2 here. 178 178
I'm gonna set it back to 2016. 179 179
And then I'll do the same for the next file. 180 180
And that's it, everything is done. 181 181
We restored our files the same way they were, 182 182
and we installed Nexpose on Kali 2016.