How to use nessus and metasploit how to#

If you’re not familiar with proxychains be sure to check out the post from last week. Step 5 – Start the nessus client and do you scan. This is as simple as changing the TCP port on the last line of /etc/nf from its default of 9050 to port 9000 and launching nessusd through proxychains as follows: Step 4 – Use PROXYCHAINS to forward your nessusd traffic through the SOCKS4 listener on port 9000.

# ssh -D 127.0.0.1:9000 -p 8000 command sets up a SOCKS4 proxy on port 9000 which is forwarded through the SSH session on the victim. Step 3 – SSH into the portfwd port you just created and setup a dynamic port forwarder on your machine. This command sets up a listener on port 8000 of the attacker’s IP (172.16.186.132) and forwards packets to port 22 on the victim’s machine (172.16.186.128). Step 2 – After you’ve installed OpenSSH and setup your account use Meterpreters PORTFWD command to forward a port from the attacker’s machine to the SSH listener on the victim’s machine. I pretty much just followed his instructions here. Joff Thyer, packet guru, crazy aussie and all around smart guy did a great job of outlining the install process on his blog. Step 1 – After you have meterpreter access install OpenSSH on the victim’s computer.

How to use nessus and metasploit how to#

Now what? How about using Nessus to scan all the services on their internal network? Here is a tutorial on how to do it. An accommodating users is more than happy to click your attachment giving you meterpreter access to their machine. You email in a carefully crafted email with the meterpreter attacked. No services are exposed externally and only HTTP/HTTPS are allowed OUT of the corporate firewall. The client’s internet face is locked down pretty well. Scenario: You are doing a penetration test. Be sure to check out DigiNinja’s post here: UPDATE (10-2010) : Metasploit SOCKS proxy is now fully functional.