External scan your own Linux system:

(1) Start the Apache 2 server on your virtual machine, and make sure your extremeinsecure Web

application and the XSS Web application that we used in Lab 3 can still be accessed from a

browser.

(2) Use a browser to visit http://:8834 and log into it using the account created at the

above Step 5(5)

(3) Lets do a Basic Network Scan for this time.

(4) Configure this scan.

Name it and use 127.0.0.1 as your target.

(5) Once you save this scan, launch it.

Check the status of this scan and wait for its completion (in a few minutes).

Question 3: (35 points)

(a) Make and paste a screenshot of your browser window for the top level of the scan report page. It

should include your URL http://:8834, the total numbers of vulnerabilities for

High, Medium, and Low severity levels.

(b) Based on the details of the scan report, what services are probably running?

(c) List the ways we can patch these vulnerabilities? Hint: its not as simple as running apt

?

get

update/ apt

?

get upgrade.

(d) Even though you may patch your systems, why is it important to scan for vulnerabilities? Think

about what Nessus does.

(e) What are the port 80 related vulnerabilities and their severity levels? Did Nessus identify the

command injection vulnerability of the extremeinsecure Web application and the Cross Site

Scripting vulnerabilities of the XSS Web application? If yes, please paste the screenshot;

otherwise, please explain why it failed to do so and propose ways to enhance Nessus for

identifying these vulnerabilities