When you enter the URL provided in the key, your browser should display an authentication box like the one noted below.

Enter the ID and password provided and you should receive the screen below.

You should select Internet Scanner to download and select \223Continue\224.

You will receive a screen noting the export restrictions on this software. Please enter the requested information and click on \223Submit\224.

You should receive the screen noted below. Please download all of the files into a single directory. If you split the downloaded files into multiple directories, the installation will fail.

The installation is fairly standard for Internet Scanner. The default directory is C:\Program Files\ISS\Scanner6. After the installation completes, you will need to restart the system.

Since new exploits are recognized and created regularly, Internet Scanner must be updated regularly. Express Update (installed with Internet Scanner) checks for current updates and applies the updates appropriately when located. Please note that Internet Scanner should not be running when Express Update is executed.

The Express Update initially looks like the screen below. The program is easy to use and intuitive.

To scan the network or specific hosts, start by running Internet Scanner. The program will note at execution time the number of current exploits used (816 at publication time).

After the program finishes loading, the menu noted below appears.

Normally, you will want to run a new session, open a session from the database, or generate a report from a previously completed scan. For this class, we are addressing new sessions. You may receive multiple keys depending on the IP addresses provided. The following screen allows you to select the key you wish to use.

Pre-configured scan policies

An \223L\224 and a number indicates the \223level\224 or intensity of scan profile. The higher the number, the more intensive and time consuming the scan performed.

To better understand the scan policies, please review the individual scan policies and create your own.

Scanning with "pings" versus command line IP addresses

Scanning without pings to locate valid hosts is necessary to scan hosts \223running in stealth mode\224 (note the screen with options below).

However, these scans can create problems with specific network equipment. You should use command line without pings only when specifying known and appropriate IP addresses (note the screen below). IP ranges should not be scanned using this option.

Custom configured scan policies

To create a custom policy, you will need to follow these steps:

1. Click on \223Add Policy\224. You will receive a screen noting the steps required to create a policy. Click on \223Next >\224.
2. You will receive a list of existing policies to use as a starting point to create your own policy. Select an appropriate policy and click on \223Next >\224.
3. You will be prompted for a name for your new scan policy. After naming your new policy, click on \223Next >\224.
4. You will see a screen similar to the one noted below. Examine the configuration options and select the scan that you need. Information Security is available for additional information and guidance.

   

5. After selecting the appropriate scan options, you need to save your scan policy and close the policy editor. Your new policy will appear in the Policy Select screen noted earlier.

Glossary of Terms

Back Door:\240\240\240\240\240\240\240\240\240\240\240 An entry point installed on a system without the system administrator\222s knowledge

Denial of Service attack (DoS): An attack that uses high-bandwidth system(s) to overwhelm a system and prevent normal system use

Exploit:\240\240\240\240\240\240\240\240\240\240\240 A program or script specifically written to compromise a system using a known security hole

Host:\240\240\240\240\240\240\240\240\240\240\240 A computer being scanned for vulnerabilities

Key:\240\240\240\240\240\240\240\240\240\240\240 A file that enables a certain computer function to work (i.e. decrypting or encrypting a file, Internet Scanner to run against a specific set of IP addresses)

Ping:\240\240\240\240\240\240\240\240\240\240\240 Sending a single packet to a system or IP and looking for a response

Trojan:\240\240\240\240\240\240\240\240\240\240\240 A program represented to do one thing while actually doing something else. Typically, a trojan will be presented as a movie or a sound file that actually installs a back door in the system.

Virus:\240\240\240\240\240\240\240\240\240\240\240\240\240 Traditionally, a program t hat infects other programs or operating systems and moves between systems with file transfers. More recently, this term and worm are merging due to Microsoft\222s problems with macro viruses, Active X, and Visual Basic Scripting.

Worm:\240\240\240\240\240\240\240\240\240\240\240\240 A program that exploits securit y holes within a system and between systems replicate across a network