Skip to main content

Posts

Nessus pro offline plugins download

Today we going to learn how to download nessus offline plugins. Before we proceed, we need to activate nessus with pro license key.  I am assuming that the nessus is activated via offline and the license key is not used anywhere else.  Lets say, in windows server nessus is installed.  Navigate the below location from command prompt and run below command: C:\Program Files\Tenable\Nessus\nessuscli.exe fetch --challenge You will get the challenge id. Copy that. Now go to the below link: https://plugins.nessus.org/offline.php Provide the challenge id and license code. Once you submit, you will get Custom URL for downloading offline plugins. Save the link as favorite.  Now do the following to install the plugins: Install plugins TAR file via the Tenable Nessus user interface: On the offline Tenable Nessus system, login first. In the top navigation bar of the Tenable Nessus user interface, click Settings . The About page appears. Click the Software Update tab. In the uppe...
Post a Comment
Read more
Recent posts

Vmware cloning feature

  Cloning is a nice feature of VMware Workstation Pro. Just right click of your vm > Manage > Clone > Then specify in which folder you want save the new cloned vm. Then start cloning. Use case: Say you need 4 windows 10 machines. Just setup one and then clone it to make it 4 Avi
Post a Comment
Read more

Nessus “remote host is dead”

 Probably the target host that you are scanning do not respond to icmp echo ping request. It may think that someone launch an attack against itself. So the host firewall on the target system may blocking what Nessus wants to do.  So here are the steps you can do: Go to nessus > select the host and choose configure. Select the scan type as custom instead of port scan (common or all ports). Now go to host discovery and turn off the ping the remote host. Hopefully your scan should work now. Thanks Mahim Avi.
Post a Comment
Read more

Kali linux mouse disappear issue fix

Kali linux mouse disappear issue fix 1. Shut down the VM. 2. Select Upgrade this virtual machine (right under Edit virtual machine settings) 3. Choose Next. 4. For Hardware Compatibility, choose Workstation 17.5 or later. 5. Choose Alter this virtual machine. 6. Choose Finish. 7. Power on the VM. Problem solved. Avi
Post a Comment
Read more

base64 decode

 Base64 decode command. Go to sans sift workstation: echo "base64 payload data" | base64 -d | iconv -f UTF-16LE -t UTF-8 iconv command is used to convert double-byte Unicode to single-byte Unicode or ascii, making the output easier to read.  Avi
Post a Comment
Read more

Importing and installing plaso in wsl

 Setting up plaso on your own windows host using wsl distro- windows subsystem for linux. First go to your linux vm and run below commands: docker must be installed on your linux vm. docker run -t --name Plaso-v20230520 log2timeline/plaso:20230520 log2timeline.py --version Link for plaso tags: If you want to pull latest docker image then from the below link find the relative tags. Here we are pulling 20230520 plaso version.  https://hub.docker.com/r/log2timeline/plaso/tags Making the .tar file that will be moved to windows vm. docker export Plaso-v20230520 > /cases/Plaso-v20230520.tar Now you can remove it from linux vm. docker rm Plaso-v20230520 Now take it to windows vm. Then open command prompt in admin mode and run below commands: mkdir C:\SANS\Plaso-v20230520 wsl --import Plaso-v20230520 C:\SANS\Plaso-v20230520 .\Plaso-v20230520.tar Avi
Post a Comment
Read more

EvtxECmd to convert events logs into csv for timeline analysis

 EvtxECmd - this tool will help us to convert event logs into csv format. Later we can use timeline analysis tool to analysis the csv data more efficiently.  This tool also help us to convert logs into json format.  Download the tool first. https://ericzimmerman.github.io/#!index.md Command : evtxecmd --sync evtxecmd -f E:\C\Windows\System32\winevt\logs\Security.evtx --csv g:\Labs\event-logs --csvf security.csv evtxecmd -f "e:\C\Windows\System32\winevt\logs\Microsoft-Windows-TaskScheduler%40Operational.evtx" --csv G:\Labs\event-logs --csvf taskscheduler.csv Windows have so many event logs and so many event id's. Not all the event id's are important. Of course you can use your own but Mark Hallman created a script that will parse all the important event id's that is discussed in SANS FOR508 course. You can use mark hallman's Process-EventLogs.ps1 tool that will parse important event id's from bulk event logs leveraging evtxecmd tool.  https://github.com/ma...
Post a Comment
Read more