It is used to spider HTML-based web pages, which are less common on the modern internet. Web Spider: Web Spider is essentially obsolete. Vulnerabilities means we are going to take the fingerprints from Assets, ports and fingerprints found in Asset discovery, apply any applicable creds, or banner grabs and kick off vulnerability checks against those assets. Combined with Asset Discovery, it will be used in a best practice scan template. Vulnerabilities: This option is optional. However, this only applies to the “Asset Discovery” check type.

This can be combined with the option below, “Use Credentials,” to do Credentialed discovery scans to get strong OS fingerprints with a free discovery scan to get a better understanding of your environment. If Asset Discovery is the only option selected, the scans are 100% free and do not count against your license. The “Full Audit without Web Spider” template is the best place to start.Īt the top of this template, there are four different “TYPES of CHECKS:”Īsset Discovery: This option is required for all scan templates, as it is the initial NMAP process we run to both find and guess the OS, as well as find open ports. While you can’t edit a built-in scan template, you can copy it and make all the changes you want to. We are going to use a starting template of the “Full Audit without Web Spider,” so find the copy icon next to that scan template, and click on it. Once you have this page open, you will see a bunch of options available. This will be the primary purpose of today’s conversation.įirst, you will need to go to the Administration page, then click on Templates > Manage under the Scan options section. And, to create the sites, we will need a good scan template. To get data into the database, we will need to create sites to scan the assets. This blog post will give you a ballpark best practice that applies to the majority of environments, as well as some descriptions that outline the thought process, math, and reasoning. Most of the best practices I plan to discuss have been around for several years and have been implemented on many engagements to refine and test them in live environments (though there may be deviations due to different environments). Because best practices are constantly changing, make sure you look at the date this blog was posted and make your decisions accordingly. When you start out with one of our vulnerability management solutions, Nexpose or InsightVM, one of the first things you should build and set up is a best practices Scan Template.

Bluestacks tweaker 4 root patch false