And let it do its thing.
And the reason we want to do is we want
to get the latest information available to us for running
up for running open boss. I can't talk.
All right. Once we've done an update, we want to do an upgrade
and yes, go through its process
and this will just take a minute
apt where to do a disk
dash upgrade
and then we'll do a ty
that sucker right there.
It's gonna go through and again, start upgrading the distribution system,
ok? And once that is being done, uh updating, we're gonna do a pseudo
and then apt
install
openvas just like that.
And of course, a Y to get that sucker in there.
And again, this is going to take a few minutes to go through its process.
All right. Once that's done, our next one is a pseudo
and then G VM dash setup or tax setup
and it's going to start going through the process of setting everything up.
This will take again a few minutes, it could take a long time.
So be prepared for a little bit of a wait
G VM D
and then
dash dash or tack tack user
equals admin.
So that's going to change our user id to admin. And then I'm going to do a new password.
So new tack tack, new tack password,
and I'm going to make that just
admin. So it's going to be
username is admin and password is admin. So admin, admin
and then we can go from there
tor a password. There we go.
So we've got a new password set up for us. Now, we just need to do a check.
So we're gonna do
pseudo
G VM D
and then I'm sorry, t
check
tak set up.
This is gonna check to make sure there is no issues with
it and that everything is running the way its supposed to.
Uh
Oh, it's GB M not GB MD
Y
is gonna run a check on it to make sure everything is working the way its supposed to.
All right, everything's good.
So the setup is complete now, set up, an installation is now complete.
So now we're actually going to use the tool.
All right.
Once we've created that username and password with the admin user,
we should copy and paste that new password into our system.
Uh The reason I do that is because if you don't,
you could easily find yourself in a week
or even two weeks where you can't remember the
password and that's an issue, right? So we're going to go to settings
and then I'm going to go right into now. This is, this is VirtualBox, right?
So we're gonna go right into the description
and you can see here, I've got my open
loss admin is my
username. And then I just put a slash my password right there
and then I can copy that password
and utilize that within my system. So let's go back into Cali.
We're gonna go back into Cali and at the top left hand side,
you should see that little Cali icon right
at the applications we're gonna click on that
and I'm just gonna type in G VM. Now, I want to do a check setup first.
So I'm going to do a G VM check setup.
It's gonna ask for the password.
I'm going to type that in, I'm gonna blow it up so you can see what's going on here
and it's literally just gonna go through and make sure that there's no issue.
There are issues, you may need to troubleshoot
and figure out what's going on.
So you can see here after a few minutes. It says GB M.
It seems like GB M 23.11 0.0 installation is ok.
So now let's actually start G VM. I'm gonna shut that down.
Let me get rid of this terminal. We don't need that anymore.
On the top left hand side, you're gonna see that little Cali icon.
We'll click on that. We're gonna type in G VM
and then we're gonna do start right here.
This is going to start our GB M services for use
and blow this up a little bit for you.
And you can see here there's IP address right here.
If after a few minutes, it doesn't automatically kick into Firefox, you can right.
Click on that and then open link,
you can see however that mine is working properly. It's going open to open the W I
and here we go.
So to make sure that it works, I'm gonna type in admin
probably help if I spelled it right. Let's try admin.
And then I'm going to paste in that password
right there and sign in.
OK?
And
that is installation, we can see that everything is installed correctly.
It's working. Let me don't save that.
You can save it if you want because it's a lab environment.
Normally something I wouldn't do.
And this is our dashboard.
Next thing we want to do is create a simple scan. Now, I've got
Kias too running in the background.
You can see it here. It's running
now. It doesn't have to be a
key. So obviously you can use any machine that you would like.
I'm gonna go to scan
tasks right there
from there. I'm gonna press that little magic wand task wizard
and you can see here that we can perform a quick scan. Now,
if you remember correctly, we know that Archa
optics two is running on 10.0 0.2 0.5 at least on my machine,
your machine may be different.
And I'm just gonna start that scan.
It's gonna go through and start requesting that scan
and you can see here that it's been requested,
providing one report, but it hasn't provided any output yet.
The first scan usually takes the longest.
Ok?
So we're just gonna wait for it.
Ok?
You can see here after I think about 15 minutes it looks
like we have our scan completed for an immediate scan of the
Coptics too.
Now, we can see here that we have a severity of high on there.
We can also see the last report date, a number of reports available,
uh, so on and so forth. We're just going to click on reports right here
port number one and it's going to open it up for us
and we're just gonna tell us we have three high 17 medium,
three low 44 log events
and zero known false positives. If I click on the actual task right there,
you can see here that opens up a process and if we scroll down a little bit,
we can see that the
scan
took 13 minutes. So I wasn't that off, I wasn't that off.
We can see user tags not available and
if there are any permissions available as well.
Uh So it provides us some of that issue or some of that
information right off the bat,
we can also see the maximum is currently scanned hosts is 20
so on and so forth. We can see the scan was configured as full and fast
using the open
VSSS default scanning parameters. All right, at
the very top right hand side, we can see total reports.
We can see at the very top over here
uh
task immediate scan results. If I click on that,
we can start to see what's going on with our actual scan.
Uh Now it lists it like this, but I'm gonna click severity
twice and that will
identify it by the severity of the different problems that we're seeing.
You can see at the very top we have a 10.0
it's going to be our highest and we can see
the operating system has reached its end of life detection.
If I want to know more about that,
I can click on that and it will tell me that the operating system
on the remote host has reached its end of life and should not be used anymore.
We can see the different aspects of it. It'll even tell us some more information.
If we scroll down,
we could see the impact end of life version operating system.
And it gives us a lot of good details on what's going on with that. If I click it again,
it cascades to back up. Let's look at deprecated SSH one protocol
here.
We can see that the summary the host is running SSH
and is providing accepting more than one deprecated versions of SSH.
The detection result is the service providing, accepting the following versions.
We go down some more.
We can see that it's deprecated SSH protocol
detection and it gives us the version number.
We can see the affected software and services.
The impact successful exploitation could
allow remote Attackers to bypass security
restrictions and obtain a client's public host key during connection
attempt and use it to open and authenticate an SSH
session
to another server with the same access solution type is vendor fix,
reconfigure the SSH server to provide only and accept SSH protocol version
SSH two.
So it provides that information and then
the different references associated with it.
If I click on
CBE 2001 0361, let's open up that in a new tab,
you can see that it provides us the base score
and it goes into the process of what calculated the different score. We can also see
um
the references associated with it vulnerable products
and the MV TS addressing the CV E
close that out.
So this is open
bossy, very quick down and dirty layer
that provides you a lot of great information.
Um I would recommend going through and scanning a few things,
go through the different reports
for your exam.
You might see a screenshot that looks something like
this that asks you to identify how many criticals,
how many majors, how many minors
uh or you know, high medium low.
You might also see something that asks you specifically about one of the
uh
specific vulnerabilities that was detected.
You might get a scenario that ask you specifically,
Paul was searching for a
or Paul has been assigned a
um
problem related to SSL,
which of the
listed vulnerabilities would you most likely aim to
identify or work first?
And your choice is obviously,
if you went through and you looked at it would
be this one right here because it's rated to 7.4
not the 7.5 because it has to do with SSH and this one is end of life detection.
So you would literally look at SSL
uh those types of questions, those scenario based questions. I wouldn't rule out,
uh I would rule out questions asking you,
you know, which, which location is associated with it or what port number.
And again, that would be over here.
OK. So this is open boss and you should be good to go
as always. It's been a pleasure.