nerdexam
GIAC

GPEN · Question #467

During a penetration test you discover a valid set of SSH credentials to a remote system. How can this be used to your advantage in a Nessus scan?

The correct answer is C. The "SSH' box can be checked to let Nessus know the remote system is running. Valid SSH credentials discovered during a penetration test can be entered into Nessus to enable credentialed scanning, which reveals far more vulnerabilities than unauthenticated scans.

Vulnerability Discovery & Scanning

Question

During a penetration test you discover a valid set of SSH credentials to a remote system. How can this be used to your advantage in a Nessus scan?

Options

  • AThis information can be entered under the 'Hydra' tab to launch a brute-forcepassword attack.
  • BThere isn't an advantage as Nessus will ultimately discover this information.
  • CThe "SSH' box can be checked to let Nessus know the remote system is running
  • DThis information can be entered under the 'credentials' tab to allow Nessus to log into the

How the community answered

(37 responses)
  • A
    3% (1)
  • B
    8% (3)
  • C
    76% (28)
  • D
    14% (5)

Why each option

Valid SSH credentials discovered during a penetration test can be entered into Nessus to enable credentialed scanning, which reveals far more vulnerabilities than unauthenticated scans.

AThis information can be entered under the 'Hydra' tab to launch a brute-forcepassword attack.

Hydra is a separate standalone brute-force password-cracking tool and is not a built-in Nessus tab or feature - it is used to find credentials, not to leverage already-discovered ones.

BThere isn't an advantage as Nessus will ultimately discover this information.

Nessus does gain a measurable advantage from valid credentials because authenticated scans expose a significantly broader set of host-level vulnerabilities that unauthenticated scans cannot detect.

CThe "SSH' box can be checked to let Nessus know the remote system is runningCorrect

Checking the SSH option and supplying discovered credentials allows Nessus to authenticate directly to the remote system and perform a credentialed scan, which assesses local patch levels, configuration weaknesses, and host-level vulnerabilities that are invisible to unauthenticated network scans. This transforms a surface-level scan into a privileged internal assessment using the found credentials.

DThis information can be entered under the 'credentials' tab to allow Nessus to log into the

Manually entering credentials under the credentials tab is a configuration step but does not by itself describe the specific SSH-based mechanism that option C identifies as the advantage in the scan.

Concept tested: Nessus credentialed SSH scanning configuration

Source: https://docs.tenable.com/nessus/Content/SSH.htm

Topics

#Nessus#credentialed scanning#SSH credentials#authenticated assessment

Community Discussion

No community discussion yet for this question.

Full GPEN Practice