‫Vulnerability scan is one of the most important parts of a penetration test or ethical hacking, vulnerability
‫scanning is an inspection of the potential points of compromising on a computer network to identify
‫security holes.
‫A vulnerability scan detects and classifies system weaknesses and computers, networks and network devices
‫and predict the effectiveness of countermeasures.
‫So let's think about the term vulnerability.
‫First, I want to show you two vulnerability definitions from two important documents.
‫The first document, ISO 27 zero five, is the name of the Prime 27000 series standard covering information
‫security risk management.
‫The standard provides guidelines for information security risk management icecream in an organization
‫specifically supporting the requirements of an information security management system defined by ISO
‫27 zero zero one.
‫So according to ISO 27 zero zero five.
‫Vulnerability is a weakness of an asset or group of assets that can be exploited by one or more threats.
‫The second document is published by Mist.
‫That's the National Institute of Standards and Technology.
‫Nest is a measurement standards laboratory and a non regulatory agency of the United States Department
‫of Commerce.
‫Its mission is to promote innovation and industrial competitiveness.
‫Nest has very good guides about cyber security, so if you were a cyber security personnel, you should
‫definitely keep your eyes on this.
‫So according to Nest, vulnerability is a flaw or weakness in a system security procedures, design,
‫implementation or internal controls that could be exercised, accidentally triggered or intentionally
‫exploited, and result in a security breach or a violation of the system's security policy.
‫Let's see the basic vulnerability detection methods.
‫By looking at an applications banner information or by obtaining version information of the application,
‫it is possible to know about potential weaknesses in that application.
‫The weaknesses found in certain versions of the applications are detected over time, and this information
‫is collected in vulnerability databases.
‫By looking at these databases, you may have information about whether there is a weakness in that application.
‫Now, protocols used by the application and communication with a client may have vulnerabilities.
‫In this case, the application can be exploited a weak encryption algorithm in communication as an example.
‫The vulnerability scanners send different types of packets over the network.
‫It examines the behavior of the service against these package and examines whether these behaviors are
‫similar to the behaviors of the vulnerable services.
‫Wrong configurations may cause vulnerabilities and weaknesses.
‫For example, if you configure your web applications authentication mechanism to allow three character
‫passwords.
‫It can very easily be cracked by attackers.
‫A vulnerability scanner is a software program designed to assess computers, computer systems, networks
‫or applications for known weaknesses and plain words.
‫These scanners are used to discover the weak points or poorly constructed parts.
‫It's utilized for the identification and detection of vulnerabilities relating to misconfigured assets
‫or flawed software that resides on a network based asset such as firewall or router, web, server,
‫application server, et cetera.
‫There are a lot of vulnerability scanners.
‫Some of them are listed in the slide.
‫We have seen and map in previous lectures as a network scanner.
‫And we also learnt that with the help of end map scripting engine NRSI, it's possible to use and map
‫as a simple vulnerability scanner.
‫Nurses is one of the most popular and capable vulnerability scanners.
‫We'll see it in detail in the next lecture.
‫Microsoft Baseline Security Analyzer provides a streamlined method to identify missing security updates
‫and common security misconfigurations.
‫It's only for Microsoft systems and we have to say that it's not an overall vulnerability scanner at
‫all.
‫But no matter what, if you have Windows systems in your network, it would be better if you use Microsoft
‫Baseline Security Analyzer.
‫Next, Posey is a commercial tool developed by Rapid7, which are the producers of Metasploit Framework.
‫It is a vulnerability scanner which aims to support the entire vulnerability management lifecycle,
‫including discovery, detection, verification, risk classification, impact analysis, reporting and
‫mitigation.
‫It integrates with Metasploit for vulnerability exploitation.
‫Open Voss is an open source vulnerability scanner that was forked from the last free version of nesses
‫after that tool went proprietary in 2005.
‫S. is a commercial vulnerability assessment tool like Nessus, it used to be free and open source,
‫but is now a commercial product.
‫Unlike an exposé and koalas, Guard St runs on Linux and Mac OS X.
‫In fact, S. is one of the few scanner vendors that don't support or run on windows at all.
‫GFI land guard.
‫Is a network security and vulnerability scanner designed to help with patch management network and software
‫audits and vulnerability assessments.
‫The price is based on the number of IP addresses you wish to scan.
‫A free trial version up to five IP addresses is available.
‫This guard is a popular code based SARS software as a service vulnerability management offering.
‫Its web based UI offers network discovery and mapping, asset prioritization, vulnerability assessment
‫reporting and remediation tracking according to business risk.
‫Secunia personal software inspector is a free security tool designed to detect vulnerable and outdated
‫programs and plug ins that expose your PC to attacks.
‫Attacks exploiting vulnerable programs and plug ins are rarely blocked by traditional antivirus programs.
‫Secunia PSI checks only the machine it is running on, while its commercial sibling Secunia CSI corporate
‫software inspector.
‫I know you TV fans are thinking anyway that scans on multiple machines on a network.
‫So a vulnerability database is a platform aimed at collecting, maintaining and disseminating information
‫about discovered vulnerabilities targeting real computer systems.
‫The database will customarily describe the identified vulnerability, assess the potential infliction
‫on computer systems and the workaround required to assist a hacker.
‫Now here are the most known vulnerability databases.
‫Open sourced vulnerability database OS viBed was an independent and open source database.
‫The goal of the project was to provide accurate, detailed, current and unbiased technical information
‫on security vulnerabilities.
‫The project promoted greater and more open collaboration between companies and individuals.
‫The project was started in August 2002 at the Black Hat and DEFCON conferences by several industry notables
‫on the 5th of April 2016.
‫The database was shut down, although the blog will continue.
‫The national vulnerability database is the U.S. government repository of standards based vulnerability
‫management data represented using the security content automation protocol scab.
‫This data enables automation of vulnerability management, as well as security measurement and compliance.
‫Envied includes databases of security checklists, security related software, flaws, misconfigurations,
‫product names and impact metrics.
‫CV details Dot Com is a free CV security vulnerability database information source.
‫You can view CV vulnerability details, exploit references, Metasploit modules, a full list of vulnerable
‫products and CVSS score reports and vulnerability trends over time.
‫CBE, common vulnerabilities and exposures is the system that provides a reference method for publicly
‫known information security vulnerabilities and exposures.