Hey everybody.
Welcome to the next video.
We're gonna be talking about vulnerability scanners and this video.
So bone scanners are vulnerable to scanners or is a complex piece of software that can be used to scan
a host or network for a large set of common issues.
Now this can range anything from a CBE or a remote or a RC for remote code execution or maybe something
is just out of date.
It could be for a large large large variety of issues sometimes in the hundreds of thousands of types
of issues depending on the scanner.
Now why do we use these.
This is a this is a very very quick way together a lot of information and it can provide a lot of useful
information for an attack for a red team or but should we only use that.
No.
Think of this as just another tool to get to get to a bigger picture just like what recon all the recon
tools we've kind of talked about what passive or active.
This is all to paint a much bigger picture of your target and get as much information as possible using
a bone scanner is a good way to miss like 50 percent of what you're looking for.
So yeah you can find the ports that are open.
You could find the common issues and maybe does some banner grabbing and depending on the service available
it might give you a known issue but that's really it.
So when it comes to like banner grabbing a custom binary or a port or a service it's on a different
port or UDP in general depending on how you've configured it it might not catch any of that.
So it's important to use this as another piece of the tool set that you are already using when looking
at engagement.
Now what do we look for when we're looking at vulnerability scanners.
Now the most vulnerable these scanners labeled and by critical medium low in information all so critical
being the highest informational being the lowest.
The main focus that you're going to probably end up looking at is critical medium.
However you don't want to ignore lower informational because they might provide subtle bits of information
that might make an attack work later in the future such as a particular SSA your version right.
That might not be shown like for example the vulnerability scanners database might not show a known
issue with that SSA version.
However you might have seen a twitter post that showed a new PRC exploit for that same version that
hasn't been added to the scanner yet.
So never never ignore informational or lows just do a quick brief Look just make sure that you've read
through them and you have a general idea of what they are.
So in case anything any little piece that you might need later when trying to build an attack you wind
up having it.
Now this is all as far as going to do is go into vulnerability scanners but above this video you'll
find a link to download a vulnerability scanner called Nexus and there will also be a tutorial on how
to use NASA's.
What I want you to do is download it you can download it for Mac Windows Linux doesn't matter the download
link is there's availability for all of it it goes to an install guide install is pretty straightforward
just like anything else we've been stalled However do note that it is a web app so it will you'll need
to open your web browser to a specific port and it'll tell you that when you set it up and it'll give
you a default credentials if there's not.
It should just bring you to a set up page.
So what I want you to do is use that NASA scanner and following the tutorial.
Go ahead and scan your local network only stuff only host that you own.
Now keep in mind that with Nexus you have to be careful around or not just nurses but any vulnerability
scanner.
Most of them have a free to use home and educational restriction put on them.
So if you're at home or for educational purposes you're testing the scanner out.
It's completely free.
However if you start scanning enterprise networks you're supposed to pay for it and you do not want
them breathing down your neck later saying you owe them X amount of money for so many hosts that you
scan.
So just keep that in mind if you're using it at home free.
Good you're good to go scan as much as you want but as soon as you make it commercial or you're in enterprise
then you're going to have to start paying for it and some of these vulnerability scanners are not cheap.
Nexus for example can go up upwards of 10 or 15 thousand dollars per license depending on how many hosts
you plan on scanning but play around with it see what's available and what's vulnerable on your local
network and kind of go through the output that it provides so you can get a better idea of kind of what
you're looking at when you use some of these types of tools.