MODULE 7: FINAL PROJECT
1
Module 7 Assignment: Final Project
School of Professional & Continuing Education, University of San Diego
CSOL-570-03-SP23 Network Visualization and Vulnerability Detection
Professor John McCready, Ph.D.
February 27, 2023
MODULE 7: FINAL PROJECT
2
Contents
Introduction ......................................................................................................................... 4
Trade Studies ...................................................................................................................... 4
Network Visualization Tool: Nagios .............................................................................. 4
Table 1 – Comparison: Nagios Core vs Zenoss .............................................................. 4
Figure 1 – Nagios Core: Home Page .............................................................................. 6
Figure 2 – Nagios Core: Host Dashboard ....................................................................... 6
Figure 3 – Nagios Core: Network Map........................................................................... 6
Vulnerability Scanning Tool: Nessus ............................................................................. 7
Table 2 – Comparison: Nessus vs Nexpose .................................................................... 7
Figure 4 – Nessus Client Interface .................................................................................. 8
Figure 5 – Nessus Scan Results: Kali VM ...................................................................... 9
Figure 6 – Nessus Scan Results: Metasploitable 2 VM .................................................. 9
Virtual Lab Architecture ................................................................................................... 10
Figure 7 – Network Diagram: Virual Lab Dell Host .................................................... 12
Figure 8 – Network Diagram: Virual Lab MacBook Host ........................................... 12
Security Toolkit ................................................................................................................ 12
Table 3 – Kali Linux Security Toolkit .......................................................................... 12
Surveillance and Reconnaissance Processes ..................................................................... 14
MODULE 7: FINAL PROJECT
3
Lessons Learned and Final Thoughts ............................................................................... 16
References ......................................................................................................................... 18
MODULE 7: FINAL PROJECT
4
Introduction
Throughout the duration of CSOL-570-03-SP23 Network Visualization and Vulnerability
Detection, each student installed and configured their own virtual lab test environment,
conducted trade studies to explore the various network security tools available to the community,
and then performed network surveillance and reconnaissance and even exploitation activities
against hosts in their lab environment. The students conducted lessons each week that prepared
them for the week’s topics before actually getting behind the keyboard to gain valuable firsthand knowledge of the capabilities of and how to use various network security tools, and even
how to demonstrate how various critical vulnerabilities can be exploited by malicious cyber
actors if left unmitigated. The following sections will elaborate on those topics providing more
details insight into the value gained from participating in this exciting course.
Trade Studies
During the course, each student was asked to conduct two trade studies from the wealth
of available network security tools; one for a network visualization tool and the other for a
vulnerability scanning tool.
Network Visualization Tool: Nagios
There are too many great network visualization tools to list them all and for the purpose
of this trade study, the students were asked to quickly review many different tools but only
conduct their detailed comparison on two different applications and then install and configure
their selected application. The two different applications that were selected for the network
visualization tool trade study were Nagios Core and Zenoss.
Table 1
Product Comparison: Nagios Core vs Zenoss
MODULE 7: FINAL PROJECT
Overview
Licensing
Model
Key Features
OSs Supported
Gartner Rating
Finance Online
Rating
Website
5
Nagios Core
An enterprise-class network
monitoring, alerting, and analysis
solution that enables users to monitor
complex networks and visualize IT the
status of their critical IT infrastructure
Free trial version available;
subscription services available at
various levels
• Comprehensive IT Infrastructure
Monitoring
• Configuration Wizards
• Network Incident Alerts
• Network Capacity Planning
• Network Infrastructure
Management
Windows, Mac, Linux, Web-based
4.3/5 with 168 reviews
4.6 /5 with 14 reviews
Zenoss
A powerful suite of network monitoring
tools that provides real-time the
monitoring of physical and virtual
networks whether on-premises, in the
cloud, or a hybrid of both
Free trial version available; subscription
services available at various levels
•
•
•
•
•
•
Networking Device Monitoring
Server Monitoring
Storage Monitoring
Application Monitoring
Cloud Monitoring
Virtualization Monitoring
Windows, Mac, Linux, Web-based
5.0/5 with 1 review
0 reviews
https://www.nagios.org/projects/nagios- https://www.zenoss.com/product/networkcore/
monitoring
(FinancesOnline, 2023; Gartner, 2022; Nagios, 2022; Zenoss, 2022)
Nagios Core and Zenoss are both great network visualization applications, but Nagios
Core was ultimately selected for installation into the virtual lab environment primarily because
various websites stated that Nagios was the de facto industry standard and that it had far better
customer reviews.
Nagios Core was installed onto a freshly deployed CentOS Stream 9 Virtual Machine
(VM) as suggested by the installation guide. There were several dependencies that needed to be
installed and a few minor pre-installation configurations that needed to be made before the VM
was ready for the Nagios Core installation, but it was not an overly difficult process for anyone
who has experience working with Linux. It would probably prove to be a difficult task for
anyone unfamiliar with Linux. Nagios Core is a client/server-type application and is accessible
by browsing to http://localhost/nagios after starting both the Nagios Core server application and
the Apache HTTP application (systemctl enable nagios and systemctl enable httpd). Hosts
MODULE 7: FINAL PROJECT
6
need to be manually entered into the free “Core” version of Nagios, and this has to be done by
using any Linux text editor on the Nagios configuration file located at:
/usr/local/nagios/etc/objects/localhost.cfg. The following figures are screenshots from the
Nagios Core Client Interface:
Figure 1
Nagios Core: Home Page
Figure 2
Nagios Core: Host Dashboard
Figure 3
MODULE 7: FINAL PROJECT
7
Nagios Core: Network Map
Vulnerability Scanning Tool: Nessus
Similar to the network visualization tool trade study, there are too many great
vulnerability scanning tools to list them all and the students were asked to perform a high-level
review of many applications before selected two for a detailed comparison and one to install and
configure in their lab environment. The two vulnerability scanning tools that were selected for a
detailed comparison were Tenable Nessus and Rapid7 Nexpose.
Table 2
Product Comparison: Tenable Nessus vs Rapid7 Nexpose
Criteria
Free version
Paid version license
model
Authentication methods
Tenable Nessus
Nessus Essentials
By number of years
Rapid7 Nexpose
Nexpose Community Edition
By number of scannable IPs
•
•
Hardware scanner
available (can improve
scanner performance)
Support for Microsoft
Windows
Offers APIs
No
• SSH
• Password
• Kerberos
• LDAP
Yes
Yes
No
No
Yes
SSH
Password
MODULE 7: FINAL PROJECT
Gartner Review Score
Novel Features
Website
8
4.5/5 with 806 ratings
Widely used by the DoD as the
Assured Compliance Assessment
Solution (ACAS)
www.tenable.com/products/nessus
4.3/5 with 511 ratings
Scan results can be integrated
directly into Metasploit
www.rapid7.com/products/nexpose/
(All About Testing, 2022; Gartner, 2023; Rapid7, 2023; SourceForge, 2023; Tenable, 2023)
Nessus and Nexpose are both great products but due to its wide-ranging customer base,
especially amongst the Federal Government and the fact that it has slightly higher customer
reviews, Nessus was selected for installation and configuration in the virtual lab environment.
Nessus is also a client/server-type application, and it was installed on the Kali Linux VM
in the lab. Nessus did not require any dependencies that were not already included in Kali by
default, and the installation process was much easier compared to Nagios, just download the
current version and apply the dpkg -i command to the downloaded installation file. Similar to
Nagios, the Nessus application/service needs to be started (systemctl start nessusd.service)
after which the Nesses client interface can be accessed through Firefox at http://kali:8834.
Figure 4
Nessus Client Interface
MODULE 7: FINAL PROJECT
9
The only VMs that were scanned for vulnerabilities during the case study were the local
host Kali VM that was running Nessus and the Metasploitable 2 VM. After installing Kali from
ISO all of the most current updates were installed, so there were no real vulnerabilities
discovered during its scan. The only thing that showed on the scan result was a medium-level
vulnerability stating that the SSL certificate could not be trusted which is not surprising because
this lab did not involve requesting actual SSL certificates from a trusted certificate authority.
Figure 5
Nessus Scan Results: Kali VM
The same cannot be said for the Metasploitable 2 VM which is left vulnerable by design
for testing purposes. Its scan results described 33 critical, 94 high, and 141 medium-level
vulnerabilities with the first one being the infamous Log4j Java vulnerability that plagued the
industry during the Holiday Season of 2021.
Figure 6
Nessus Scan Results: Metasploitable VM
MODULE 7: FINAL PROJECT
10
Virtual Lab Architecture
The virtual lab environment was spread out amongst two different host hypervisor
laptops, one Dell PC running Windows 10 and Oracle Virtual Box and one MacBook running
macOS Ventura and Parallels Pro. The decision to use two host machines was only made due
towards a personal preference towards Macs and the fact that the Metasploitable VM is not
compatible with the host computers running Apple Silicon processors. The following VMs were
installed throughout the lab:
•
Computer Name: Kali
o Hypervisor Host: MacBook and Dell PC
o Operating System: Kali Linux
o IP: 192.168.10.101 (Dynamically assigned on both hosts)
o Purpose: Serve as the primary network security test management VM. Comes
preconfigured with all of the leading penetration testing tools used for
testing/validating network defenses and security controls.
•
Computer Name: WebGoat
o Hypervisor Host: Dell PC
MODULE 7: FINAL PROJECT
11
o Operating System: Ubuntu Linux
o IP: 192.168.10.103 (Dynamically assigned)
o Purpose: An internationally vulnerable Java-based web application that can be
used to as a scanning and attack target to gain a better understanding of common
Java web application vulnerabilities and their potential consequences if not
properly mitigated.
•
Computer Name: Metasploitable
o Hypervisor Host: Dell PC
o Operating System: Horribly outdated version of Ubuntu Linux
o IP: 192.168.10.102 (Dynamically assigned)
o Purpose: An intentionally vulnerable host released by Rapid7 with a slew of fully
functioning services (web applications, databases, file shares, etc.) for the purpose
of being scanned and attacked to test and demonstrate the severity of various
types of vulnerabilities and perhaps use as a sales tool for Rapid7 products.
•
Computer Name: CentOS
o Hypervisor Host: MacBook
o Operating System: CentOS Stream
o IP: 192.168.10.102 (Dynamically assigned)
o Purpose: Serve as the host for the Nagios Core server application
•
Computer Name: Ubuntu
o Hypervisor Host: MacBook
o Operating System: Ubuntu
o IP: 192.168.10.103 (Dynamically assigned)
MODULE 7: FINAL PROJECT
12
Purpose: Serve as another host for the Nagios application to communicate with.
Figure 7
Network Diagram: Virtual Lab Dell PC
Figure 8
Network Diagram: Virtual Lab MacBook
Security Toolkit
Table 3
Kali Linux Security Toolkit
MODULE 7: FINAL PROJECT
Tool Name
dmitry
legion(root)
netdiscover
nmap
recon-ng
spiderfoot
nikto
commix
skipfish
sqlmap
wpscan
cewl
crunch
13
Function
Scan for information on domains and hosts
an open source, easy-to-use, super-extensible and semi-automated
network penetration testing tool that aids in discovery, reconnaissance
and exploitation of information systems.
Netdiscover is an active/passive address reconnaissance tool, mainly
developed for those wireless networks without dhcp server, when you are
wardriving. It can be also used on hub/switched networks.
Nmap is a utility for network exploration or security auditing. It supports
ping scanning (determine which hosts are up), many port scanning
techniques, version detection (determine service protocols and
application versions listening behind ports), and TCP/IP fingerprinting
(remote host OS or device identification). Nmap also offers flexible
target and port specification, decoy/stealth scanning, sunRPC scanning,
and more.
Recon-ng is a full-featured reconnaissance framework designed with the
goal of providing a powerful environment to conduct open source webbased reconnaissance quickly and thoroughly.
Its goal is to automate the process of gathering intelligence about a given
target, which may be an IP address, domain name, hostname, network
subnet, ASN, e-mail address or person’s name.
Webserver scanner
An environment test web applications with the view to find bugs, errors
or vulnerabilities related to command injection attacks
Skipfish is an active web application security reconnaissance tool. It
prepares an interactive sitemap for the targeted site by carrying out a
recursive crawl and dictionary-based probes. The resulting map is then
annotated with the output from a number of active (but hopefully nondisruptive) security checks. The final report generated by the tool is
meant to serve as a foundation for professional web application security
assessments.
sqlmap goal is to detect and take advantage of SQL injection
vulnerabilities in web applications. Once it detects one or more SQL
injections on the target host, the user can choose among a variety of
options to perform an extensive back-end database management system
fingerprint, retrieve DBMS session user and database, enumerate users,
password hashes, privileges, databases, dump entire or user’s specific
DBMS tables/columns, run his own SQL statement, read specific files on
the file system and more.
Scan a target WordPress URL and enumerate any plugins that are
installed:
A ruby app that spiders URLs and returns a list of words that can be used
by password crackers
Crunch is a wordlist generator where you can specify a standard
character set or any set of characters to be used in generating the
wordlists
MODULE 7: FINAL PROJECT
hashcat
john
medusa
ncrack
wordlists
aircrack-ng
fern wifi cracker
(root)
kismet
reaver
wifite
crackmapexec
metasploit
framework
ettercap-graphical
macchanger
responder
wireshark
mimikatz
autopsy (root)
binwalk
14
Password cracker
John the Ripper is a tool designed to help systems administrators to find
weak (easy to guess or crack through brute force) passwords, and even
automatically mail users warning them about it, if it is desired.
Medusa is intended to be a speedy, massively parallel, modular, login
brute-forcer.
Ncrack is a high-speed network authentication cracking tool. It was built
to help companies secure their networks by proactively testing all their
hosts and networking devices for poor passwords.
A wordlist is essentially a list of passwords that are collected in plain
text. It's a text file that has a list of possible passwords that can be used to
help someone crack passwords when necessary.
A complete suite of tools for assessing WiFi network security
Wireless security auditing and attack software program
Kismet is a wireless network and device detector, sniffer, wardriving
tool, and WIDS (wireless intrusion detection) framework.
Reaver implements a brute force attack against Wifi Protected
Setup (WPS) registrar PINs in order to recover WPA/WPA2 passphrases,
as described in Brute forcing Wi-Fi Protected Setup When poor design
meets poor implementation.
Wifite is a tool to audit WEP or WPA encrypted wireless networks. It
uses aircrack-ng, pyrit, reaver, tshark tools to perform the audit.
Pentensting tool for Windows/AD environments.
The world’s most used penetration testing framework
Ettercap supports active and passive dissection of many protocols (even
encrypted ones) and includes many feature for network and host analysis.
utility that makes the manipulation of MAC addresses of network
interfaces easier.
Responder is used to poison name services to gather hashes and
credentials from systems within a local network.
Wireshark is a network “sniffer” - a tool that captures and analyzes
packets off the wire. Wireshark can decode too many protocols to list
here.
Mimikatz uses admin rights on Windows to display passwords of
currently logged in users in plaintext
A digital forensics platform and GUI
A tool for searching binary images
(Kali Linux, 2023)
Surveillance and Reconnaissance Processes
MODULE 7: FINAL PROJECT
15
To perform the following surveillance and reconnaissance activities, run the following
commands from a Kali Linux terminal:
a. Scan a network to determine the operating systems installed on hosts:
1. nmap -o 192.168.10.0/24 (-o is the switch for operating system
fingerprinting/detection)
b. Perform a dictionary attack against a host’s SSH service:
1. Launch Metasploit Framework
2. nmap -o 192.168.10.0/24 (-o is the switch for operating system
fingerprinting/detection)
3. use auxiliary/scanner/ssh/ssh_login (sets SSH as the target)
4. set USERPASS_FILE /usr/share/wordlists/<wordlist>.txt (specifies the path to the
dictionary file
5. set RHOST 192.168.10.102 (specifies the remote host or target)
6. run (begins the attack)
c. Launch an exploit payload against a vulnerable web service:
This task was not able to be performed during this class because the Rapid7 Tutorial uses
Metasploit Pro, and Rapid7 no longer provides 30-day free trials of Metasploit Pro. The
tutorial did not provide instructions for how to work with exploits and payloads using the
Metasploit Framework.
d. Identify the ports listening on a host:
1. nmap -sV 192.168.10.0/24 (-sV is the switch for service version; it will return all
open/listening ports and the versions of the service if detectable)
e. Eavesdrop on communications between two hosts:
MODULE 7: FINAL PROJECT
16
1. Launch Wireshark
2. Click the ensure the appropriate network adapter that you want to begin capturing on is
selected (probably either eth0 or wlan0)
3. Click the blue shark fin icon to begin capturing network traffic
4. Click the red stop icon to stop capturing once the desired amount of traffic has been
captured
4. Once the eavesdropping targets have been identified the following filter can help to
narrow the visable packets to only those between the two hosts: ip.src == 192.168.10.101
or ip.dst == 192.168.10.102
f. Identify the SSID of an active wireless network:
1. Launch the Kismet client http://localhost:2501
2. Click the Kismet Options and then click on Data Sources
3. Find the appropropriate wireless adapter and click Enable Source (wireless traffic will
begin being sniffed
4. SSIDs for active wireless networks will be visible on the SSIDs tab
Lessons Learned and Final Thoughts
As stated at the beginning of this course, I was fortunate enough to have had experience
with Kali Linux and most of the applications that were covered. That experience was years and
years ago, and I have not been able to work in a technical capacity for some time now, so I was
very excited to crack my knuckles, grab a pot of coffee, and get back in there. I did have the
opportunity to help a couple of my fellow students out which I was very happy to do, but it made
me feel like I would be in a rough spot if I had not had all of the experience from previous
training and experience. We were unable to use Metasploit Pro because Rapid7 stopped
MODULE 7: FINAL PROJECT
17
providing free trial versions for some reason, but I was able to get a root level shell on the
Metasploitable VM (which is no great hacker accomplishment) but I did feel a sense of
accomplishment for doing so. Demonstrating that level over brute force privilege escalation is a
very valuable demonstration tool to impress just how important mitigating and defending against
these types of attacks are for individuals who are not so technically familiar, and they are just as
if not more important at demonstrating to executive leadership that the cybersecurity personnel
within their organizations need to be taken seriously unless they want to end up on the front
page. This course was truly a breath of fresh air compared to other more administrative classes,
but I can imagine that students without a strong Linux foundation must have a hard time.
MODULE 7: FINAL PROJECT
18
References
All About Testing (AAT). (2022, August 29). Nexpose vs Nessus - Which one is
better? https://allabouttesting.org/nexpose-vs-nessus-which-one-is-better/
FinancesOnline. (2023, January 8). Zenoss review. https://reviews.financesonline.com/p/zenoss/
FinancesOnline. (2023, January 11). Nagios XI review.
https://reviews.financesonline.com/p/nagios-xi/
Gartner. (2022). Nagios XI Reviews. https://www.gartner.com/reviews/market/it-infrastructuremonitoring-tools/vendor/nagios/product/nagios-xi
Gartner. (2023). Rapid7 vs tenable. https://www.gartner.com/reviews/market/vulnerabilityassessment/compare/rapid7-vs-tenable
Gartner. (2022). Zenoss Cloud Monitoring Reviews.
https://www.gartner.com/reviews/market/aiops-platforms/vendor/zenoss/product/zenosscloud
Kali Linux. (2023). Kali tools. https://www.kali.org/tools/
Nagios. (2022). Nagios Core. https://www.nagios.org/projects/nagios-core/
Rapid7. (2023). Nexpose: Vulnerability scanner &
software. https://www.rapid7.com/products/nexpose/
SourceForge. (2023). Nessus vs. Nexpose
comparison. https://sourceforge.net/software/compare/Nessus-vs-Nexpose/
Tenable. (2023). Nessus vulnerability assessment. https://www.tenable.com/products/nessus
Zenoss. (2022). Network monitoring. https://www.zenoss.com/product/network-monitoring