Idiot's Lesson on Vulnerability Scanning

I've asked this question before and done some research, but I still just don't quite get it. Reason being, primarily, I'm just so new to this. But I've been net admin for a few months now, and it's time to really learn how to scan for vulnerabilities in a network.

Unfortunately, it's hard to find where to start learning when you don't know anything yet. The topic is so laden with tech-jargon it's almost as if you have to know something before you can learn something. So, I'm starting this thread for us idiots. Can you security gurus out there explain to us in stupid-terms where to start with this? What network scanners do we start with, for example, and once we use one for the first time, how do we interpret the "gibberish" we get? What do you look for first? How do you keep up with those thousand+ ports? When does it all make sense?!

And remember folks, stupid terms. Really stupid terms. :)

How big is your network ?
Do you know how to use linux?
http://www.insecure.org/nmap/index.html
-------------------------------------------------------- (the horse 13 typed many detailed tutorials on NMAP)
Just curious, how did you become a net admin, it seems like you were thrown to the wolves?
http://www.nessus.org/intro.html

The "Nessus" Project aims to provide to the internet community a free, powerful, up-to-date and easy to use remote security scanner.

A security scanner is a software which will audit remotely a given network and determine whether bad guys (aka 'crackers') may break into it, or misuse it in some way.

--------------------------------------------------------------------
Basics Defining a Plan of Action

http://itsecurity.com/tutor/asecurit...firsttasks.htm

Whenever you come across jargon you don't understand just research it, they have a computer jargon list here(AO) on the main board. Google and dictionary.com is where I go to find the meaning of acronyms I dont quite recall.

"Thrown to the wolves" is about right. Actually this is an internship. This is my senior year (graduating in May) for my MIS degree, and let me tell ya, what I've learned on the job has far, far surpassed anything I've learned in classes. In my six years of college, not once have I been taught real security issues. Classes have been a joke comparatively speaking. But this is the stuff I want to learn, hard way or not. It's pretty embarassing having to admit my situation among the great vets here, but ya gotta start somewhere.

I do have a little experience in Linux. In fact, I'm taking a course on it right now, and I just installed Redhat 9 on a slave drive on my home computer. I'll check out the stuff you recommended, and hopefully other newbies in my situation will come across this as well, or so was my hope in starting this thread.

If you answered 'yes' to !mitationRust's question about Linux, and find the two tools presented useful, then give Knoppix a shot. It's a GNU/Linux distribution that runs off the CD and has both these programs. So pop it in your drive, boot and check around for things.

Knoppix, Knoppix STD, PHLAK, Damn Small linux are all "Linux Live" discs, and are great for learning. Nothing will get screwed up. Unless your box has a gnome inside of it like mine does.

Friggin gnome...

Soda Pop

If you want a down and dirty overview without doing anything or paying anything download GFI Languard and use it real quick. It's not bad and detects a ton of vulnerabilities. It will tell your everything in a nice shiny report on all boxes but it really shines for you because it works on Windows and is centered around specific Microsoft security bulletins and patches.

Languard is good. Retina is better. Bit more a Resource hog, but much nicer tool. However with a little configuration, you can deploy patches with Languard. Iris is another good windows tool. Defenitly read up before operating however. Kinda hard to use at first. Great tool for a windows machine however.

I see someboduy suggested NMAP. If you use the windows version, be sure it is the command line version. The gui version is kind of broken.

Otherwise just get knoppix STD as mentioned already.

Be safe and stay free.

Thanks guys, I'll check out all those tools and see what I can learn from them. I have messed around with LanGuard before, but not enough to really have a feel for it yet.

i really good security scanner would be at www.languard.com
download the 30day trial.
it is an exelent program

Retina, ISS Internet Scanner, Still Secure VAM, Symantec Net Recon and CA e-Trust are some of the big names in the business. Nessus is a great Unix based freebie. Check out Asmodeus security tool.Its free too. I am actually involved in a project on vulnerability assessment and deployment right now.

Languards nice.. Never use shadow scanner that ****'s still "listening" on my netstat and i uninstalled it and deleted the keys more then a day ago.. Maybe it's just me.

Anyway, can anyone point me how to learn scripts for languard? It'd be nice to know.

Close that port that it's listening on "insidedout".
I prefer retina.
Retina is a great scanner.
If you don't understand how it works at first, try it on yourself so yuo can get a better understanding of it.
Retina,Iris,Xscanner, Etc Etc really pending on your current os.
- TuX

Ok guys, I just learned about the netsat command. So, I ran netstat -a, and here's what I have:

Active Connections

Proto Local Address Foreign Address State
TCP JAMES:ftp JAMES.HIFS:0 LISTENING
TCP JAMES:epmap JAMES.HIFS:0 LISTENING
TCP JAMES:microsoft-ds JAMES.HIFS:0 LISTENING
TCP JAMES:1056 JAMES.HIFS:0 LISTENING
TCP JAMES:1076 JAMES.HIFS:0 LISTENING
TCP JAMES:1133 JAMES.HIFS:0 LISTENING
TCP JAMES:1162 JAMES.HIFS:0 LISTENING
TCP JAMES:1540 JAMES.HIFS:0 LISTENING
TCP JAMES:2058 JAMES.HIFS:0 LISTENING
TCP JAMES:2062 JAMES.HIFS:0 LISTENING
TCP JAMES:2063 JAMES.HIFS:0 LISTENING
TCP JAMES:42510 JAMES.HIFS:0 LISTENING
TCP JAMES:1161 JAMES.HIFS:0 LISTENING
TCP JAMES:1161 JAMES.HIFS:1162 ESTABLISHED
TCP JAMES:1162 JAMES.HIFS:1161 ESTABLISHED
TCP JAMES:netbios-ssn JAMES.HIFS:0 LISTENING
TCP JAMES:1073 JAMES.HIFS:0 LISTENING
TCP JAMES:1073 DATASERV0:netbios-ssn ESTABLISHED
TCP JAMES:1133 FMKSERV:5003 ESTABLISHED
TCP JAMES:1540 JAY:microsoft-ds ESTABLISHED
TCP JAMES:2058 216.239.41.99:http ESTABLISHED

What does this tell me? Are the ports marked as "listening" of any concern? I know all the ports from 1162 down are for local network stuff, but I'm still trying to learn how to read what I'm looking at. If there was something malicious going on, what might it look like (just an example or something)?

if you run netstat -ano you will get more usefull info.
for a list of all the netstat commands just type "netstat ?" no quotes.