Scribd
Upload
7 views

Finding Vulnerabilities

Uploaded by

hungnd24fpt
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
7 views

Finding Vulnerabilities

Uploaded by

hungnd24fpt
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 21

Finding Vulnerabilities

Contents
 Nessus

 Nmap scripting engine

 Metasploit

 Web application scanning

 Manual analysis
1. Nessus
Nessus
 Tenable Security’s Nessus is one of the most widely used commercial

vulnerability scanners, though many vendors provide comparable products

 Using TCP port 8834

 root@kali:~# service nessusd start


Nessus
Nessus
Nessus
Nessus
 Nessus ranks vulnerabilities based on the Common Vulnerability Scoring

System (CVSS), version 2, from the National Institute of Standards and


Technology (NIST). Ranking is calculated based on the impact to the
system if the issue is exploited
2. Nmap scripting engine
Nmap scripting engine
 The available scripts fall into several categories, including information

gathering, active vulnerability assessment, searches for signs of previous


compromises
Nmap scripting engine
 #nmap --script-help <ten_catelogy>
Nmap scripting engine
3. Metasploit
Metasploit scanner modules
 Metasploit can conduct vulnerability scanning via numerous auxiliary

modules. These modules will not give us control of the target machine, but
they will help us identify vulnerabilities for later exploitation
Metasploit exploit Check Functions
 Some Metasploit exploits include a check function that connects to a target

to see if it is vulnerable, rather than attempting to exploit a vulnerability


4. Web application scanning
Web application scanning
 Nikto
Web application scanning
 Acunetix Web Vulnerability Scanner
5. Manual analysis
Manual analysis
 Exploring a Strange Port
Manual analysis
 Finding Valid Usernames

You might also like