• Skip to main content
  • Skip to primary sidebar
  • Skip to footer

securitywing

Steps to Check Windows Server Vulnerability with Nexpose Community Edition

by wing

There are only a handful of tools for checking Windows server vulnerabilities. If you are familiar with Microsoft security tools testing tools you may have noticed that  their tools focus on the security configuration setting of the server. What if your server has a number of applications such as PHP, MySQL or any other database related extension. Rapid7 has a community edition(free edition) for checking Windows server vulnerabilities. Securitywing has tested this edition of Nexpose in a test environment built with a Windows 2008 r2 server.  The followings are the procedures  you can follow to check your windows security.

This post will show you step-by-step procedures to check vulnerability of Windows servers. Before showing you the details steps, let me clarify that  the server used for testing was a newly configured web server and no security settings of the of the server was changed before running vulnerability scan with Nexpose.

Check out the following steps:

1. You have to download the Nexpose community edition from : rapid7.com/products/nexpose/download.jsp. If you do not have any account, you can create one and download the editing that you need. Next, check your email address to receive you free license code.

nexpose installation

add exception

2. Once you install Nexpose you  can start scanning your server for vulnerability. Remember that Nexpose expects your server to have a 8 GB of RAM. However, Nexpose worked  smoothly in our test server with 4 GB of RAM. When you strat Nexpose for the first time,  you might get a message stating that “This connection is untrusted”; ignore it by clicking on ” I understand the message” and  “Add Exception”. Next, click on “confirm security exception”.

3. Allow a few minutes to start the security console.

nexpose security console starting4. Next, click on the new site. See the screenshot below for more details.add new site

5. Now, Nexpose will show your server IP address in the included asset list. Just click on “Next”, under “site configuration”.

included asset IP

6. Now, click on the Scan icon to start  the scan.

scan

7.  Click on “start now” and wait until  scanning get finished.

start now

 

8. Checkout the number of found vulnerabilities.

vulnerability

 

9. Report on severity of each vulnerability.

vulnerablity by severity

10. Click on the reports tab

create vulnerablity report

11. Generate a report: Click on the reports tab and then click on new give a name to your report. select the file format.  in this report, we wanted to generate our report in pdf format. Click on “select sites and assets”, under the scope tab. Finally click on run the report.

saving vulnerability report as pdf If you follow the above mentioned steps you should have no difficult generating a vulnerability report for your Windows server. Generating a vulnerability report and having a look at it is not all Nexpose does. The best part of
Nexpose is that it will give you the link for patches that you can download from Microsoft to secure your server.

Related posts:

  1. Project Manager Interview Questions and Answers
  2. How to Share Internet Connection using Android Mobile Tethering
  3. 3 Steps to Install Kubectl, Helm 3 and S3 Plugin in Ubuntu to Store Charts in S3 Bucket
  4. Top 10 Cloud Based Threats

Filed Under: Off Track

Primary Sidebar

Please help us sharing

Categories

  • AWS
  • Basics
  • Containers
  • Cryptocurrency
  • Cyber
  • Internet Security and Safety
  • IS Audit
  • IT Security Exams
  • Law & Human Rights
  • Network Security Tips
  • Off Track
  • Social Media Governance
  • Tech Comparisons
  • Tech Stack Suitability
  • Telecom
  • Tutorial

CISSP Sample Test

Take a CISSP Sample Test

CISA Sample Test

CISA IT governance Sample test

Please Follow Us

Contact us for Ads

Go to Contact Form

Search

Footer

Copyrights

Protected by Copyscape Duplicate Content Detection Software

Securitywing.com reserves the copyrights of all of its published articles.No contents of this site is permitted to be published to anywhere else in the Internet.If any contents are found in any other websites, securitywing reserves the rights to file a DMCA complaint. But you have the right to use the link of any relevant article of this site to point from your website if you consider that it might improve the quality of your article.

Tags

audit AWS backup basics browser check cisco cloud computer configuration cyber data database email gmail hsrp ids iis informaiton internet kubernetes linux load balancing malware microsoft network protection redundancy risk router security security tips server social media SSL switch test tools vpn vrrp web webserver website windows wordpress

Copyright © 2010-2025 ·All Rights Reserved · SecurityWing.com