SOC DETECTION LAB

SOC DETECTION

This lab setup shows how to detect and scan for different vulnerabilites on your target machine(s).

Security Operation Center Overview

CONFIGURATIONS: SSH, APACHE2 SERVER, NGINX AND NESSUS ESSENTIALS

Here’s a comprehensive step-by-step guide on configuring and installing SSH in Kali Linux

Introduction

Secure Shell (SSH) enables secure remote access to Kali Linux machines. This tutorial outlines SSH installation, configuration, and security enhancements.

Installing SSH

1. Update repositories: ‘sudo apt update’. This is used to update the package list

2. To install OpenSSH server: use ‘sudo apt install openssh-server-y’

3. Start SSH service: ‘sudo systemctl start ssh’

4. Enable SSH autostart: ‘sudo systemctl enable ssh’. This will enable SSH to start on boot

To make the SSH usable for this purpose, there is need to edit the configuration file. Configuring SSH

1. Edit configuration file: sudo nano /etc/ssh/sshd_config

2. Disable root login: PermitRootLogin no by looking for the line that says: PermitRootLogin prohibit-password then Changeit to: PermitRootLogin yes

3. Enable Authentication Methods: Find the line: PasswordAuthentication no then Change it to: PasswordAuthentication yes

4. After done with the editing, save with Ctrl + O, to exit the nano editor you can make use of Ctrl + X.

5. Ensure to restart SSH service: sudo systemctl restart ssh to apply the changes

6. Check the status of SSH: Verify that the SSH service is running: sudo systemctl status ssh. You can even do this before starting the whole installation to check if ssh is working already on your Kali.

The above screenshot shows SSH is now working perfectly on your Kali Linux. To troubleshoot for ssh: sudo journalctl -u ssh.

Here’s a comprehensive step-by-step guide on configuring and installing Apache2 server in Kali Linux:

Apache2 is a popular, open-source web server software.

Installation

1. Update repositories: ‘sudo apt update’. This is used to update the package list

2. To install Apache2 server: use sudo apt install apache2 -y

3. Start Apache service: ‘sudo systemctl start apache2’

4. Enable Apache autostart: ‘sudo systemctl enable apache2’. This will enable Apache to start on boot

Configuring Apache

1. Edit Apache2 configuration file: sudo nano /etc/apache2/apache2.conf

2. Configure server name and port: ServerName [your_domain_name]:80

3. Document root directory: DocumentRoot /var/www/html and allow HTTP Methods, Add or modify the configuration to allow HTTP methods like DELETE and PUT. Locate the section for your server settings (or add it if it doesn’t exist):

What to add (if it doesn’t exist)

ServerName localhost:80

You need to replace localhost with your actual domain or IP:

ServerName 127.0.0.1(Localhost):80 OR ServerName 192.168.x.x (your IP):80

Then:

<Directory /var/www/html> Options Indexes FollowSymLinks AllowOverride All Require all granted

<LimitExcept GET POST PUT DELETE HEAD OPTIONS> Deny from all </LimitExcept> </Directory>

4. After you are done with the editing, save with Ctrl + O, and to exit the nano editor you can make use of Ctrl + X.

5. Restart Apache2 service: sudo systemctl restart apache2 to apply the changes

6. Check the status of SSH: Verify that the SSH service is running: sudo systemctl status apache2. You can even do this before starting the whole installation to check if Apache is working already on your Kali.

Here’s a comprehensive step-by-step guide on configuring and installing Nginx in Kali Linux:

Nginx is a lightweight, high-performance web server.

Installing Dependencies

1. Update repositories: sudo apt update

2. Install required packages: sudo apt install build-essential libpcre3 libpcre3-dev libssl-dev zlib1g-dev libgd-dev libxml2 libxml2-dev uuid-dev

Downloading Nginx Source Code

1. Download Nginx source code: wget http://nginx.org/download/nginx-1.15.5.tar.gz

2. Extract tarball contents: tar-zxvf nginx-1.15.5.tar.gz

3. Navigate to extracted directory: cd nginx-1.15.5

Installing Nginx

To install the nginx run the following commands simultaneously or together

cd nginx-1.15.5

./configure

make

sudo make install

You can now start Nginx with the following command: sudo /usr/local/nginx/sbin/nginx

To check if Nginx is running, you can use: sudo nginx-t

Here’s a comprehensive step-by-step guide on downloading and installing Nessus Essentials in Kali Linux:

Nessus Essentials provides vulnerability scanning and compliance monitoring. You can follow this video as well: **https://www.youtube.com/watch?v=yO3QiRMDDes**

1. Go to Nessus (tenable) Website: **https://www.tenable.com/products/nessus/nessus-essentials **from your browser within your kali Linux.

1. I used Mozilla Firefox
2. Register by by providing your username, name and valid email address. An activation code will be sent to your email, copy it you will need it later.
3. Afterwards, go to Products and Download Nessus
4. After downloading, navigate to Downloads: cd Downloads and install Nessus uisng the command sudo dpkg -i nameofdownloadedfile, for me I used sudo dpkg -i Nessus-10.8.3-ubuntu1604_amd64.deb

5. Start Nessus using command: sudo systemctl start nessusd

6. Then go to your browser and enter: ***https://kali:8834/***

7. You will be able to access Nessus from your browser now, you will see a screen at first asking for the activation code sent earlier to you, enter it here. Then register your account

8. After that you will be welcome with a screen showing your dashboard. Now you can start your scan tests. Nessus will take a while lading all its plugins. Allow it.

Afterwards, you will get this screen enter the targets you want to scan, you can also do this later when you are ready to scan.

Now you start your scan by clicking on New scan.

After clicking on new scan you will be given a series of templates to make use of, configure it (using settings) to what you want and don’t forget to select your target

Your scans will appear under my tabs where you can manage and monitor your scans. Check the screenshots for samples of how your scan results will look like

Finally, you can also configure Nessus to automatically send a notification report to your Gmail after each successful completed scan. Follow the steps below:

Steps

1. Configure SMTP for Email Reports:

○ GotoNessusSettings > SMTP Server.

○ Set the SMTPHost to smtp.gmail.com.

○ SetEncryption to TLS.

○ Set the Port to 587.

2. Generate a Gmail App Password: To securely send emails, generate a Gmail app password.

Steps:

○ Login to your Gmail account.

○ Go to your Google Account Settings.

○ Under Security, ensure 2-Step Verification is enabled.

○ Find and click on App Passwords.

○ Create an app password specifically for Nessus.

○ Copythegenerated password. 3. Enter SMTP Credentials: ○ Enter your Gmail address as the username.

○ Use the app password you generated as the password.

○ Set both From Address and To Address to the desired email.

4. Test the Configuration:

○ Send a test email to confirm the SMTP setup

Now, you can scan and detect vulnerablities within your network.

YAAY!!!