So there we've scanned the network and discovered all the system ports and services.
But now it's time to scan for vulnerabilities.
Vulnerability scan is one of the most important parts of a penetration test or ethical hacking. Vulnerability
scanning is an inspection of the potential points of compromising on a computer network to identify
security holes. A vulnerability scan detects and classified system weaknesses and computers networks and
network devices and predict the effectiveness of countermeasures.
So let's think about that term vulnerability first.
I want to show you two vulnerability definitions from two important documents.
The first document ISO 27005 is the name of the prime 27000 series standard covering information
security risk management. The standard provides guidelines for information security risk management (ISRM)
in an organization. Specifically supporting the requirements of an information security management system
defined by ISO 27001
So according to ISO 27005, vulnerability is a weakness of an asset or group of assets that
can be exploited by one or more threats.
The second document is published by NIST. That's the National Institute of Standards and Technology. NIST
is measurement standards laboratory and a non-regulatory agency of the United States Department of Commerce.
Its mission is to promote innovation and industrial competitiveness.
NIST has very good guides about cybersecurity. So, if you are cyber security personnel you should definitely
keep your eyes on this.
So according to NIST vulnerability is a flaw or weakness in a system security procedures design implementation
or internal controls that could be exercised accidentally triggered or intentionally exploited. And result
in a security breach or a violation of the systems security policy.
Let's see the basic vulnerability detection methods by looking at an application's banner information
or by obtaining version information of the application.
It is possible to know about potential weaknesses in that application.
The weakness is found in certain versions of the applications are detected over time and this information
is collected in vulnerability databases. By looking at these databases
you may have information about whether there is a weakness in that application.
Now protocols used by the application in communication with the client may have vulnerabilities.
In this case the application can be exploited.
A weak encryption algorithm in communication is an example.
The vulnerability scanners send different types of packets over the network. It examines the behavior
of the servers against these packets and examines whether these behaviors are similar to the behaviors
of the vulnerable services. Wrong configurations may cause vulnerabilities and weaknesses.
For example if you configure your web applications authentication mechanism to allow three character
passwords. It can very easily be tracked by attackers.
A vulnerability scanner is a software program designed to assess computers, computer systems, networks
or applications for known weaknesses.
In plain words these scanners are used to discover the weak points or poorly constructed parts. It's
utilized for the identification and detection of vulnerabilities relating to misconigured assets or
flawed software that resides on a network based asset. Such as firewall, router, web server, application,
server etc..
There are a lot of vulnerabilities scanners.
Some of them are listed in the slide. We have seen and Nmap in previous lectures
as a network scanner and we also learnt that with the help of Nmap Scripting Engine "NSC". It's possible
to use and Nmap as a simple vulnerability scanner. Nessus is one of the most popular and capable vulnerability
scanners. We'll see it in detail in the next lecture. Microsoft Baseline Security Analyzer provides a
streamlined method to identify missing security updates and common security misconfiguration.
It's only for Microsoft systems and we have to say that it's not an overall vulnerability scanner at
all.
But no matter what, if you have Windows systems in your network it would be better if you use Microsoft
baseline security analyzer. Nexpose
is a commercial tool developed by Rapid 7 which are the producers of Metasploit Framework.
It is a vulnerability scanner which aims to support the entire vulnerability management lifecycle. Including
discovery, detection, verification, risk classification, impact analysis, reporting and mitigation.
It integrates with Metasploit for vulnerability exploitation. OpenVAS is an open source vulnerability
scanner that was forked from the last free version of Nessus.
after that tool went proprietary in 2005. SAINT is a commercial vulnerability assessment tool. Like Nessus
it used to be free and open source but is now a commercial product. Unlike Nexpose, and QualysGuard,
SAINT runs on Linux and Mac OS X.
In fact, SAINT is one of the few scanner vendors that don't support (run on) Windows at all. .GFI LANGuard
is a network security and vulnerability scanner designed to help with patch management network and software
audits and vulnerability assessments.
The price is based on the number of IP addresses you wish to scan.
A free trial version up to 5 IP addresses is available. QualysGuard is a popular code based SaaS (software as a service)
vulnerability management offering. It's web-based UI offers network discovery and mapping, asset
prioritisation, vulnerability assessment reporting and remediation tracking according to business risk.
Secunia PSI (Personal Software Inspector) is a free security tool designed to detect vulnerable and
outdated programs and plugins that expose your PC to attacks. Attacks exploiting vulnerable programs
and plugins are rarely blocked by traditional anti-virus programs.
So Secunia PSI checks only the machine it is running on while it's commercial sibling Secunia CSI (Corporate
Software Inspector).
I know you TV fans are thinking, anyway that scans on multiple machines on a network. So all vulnerability
database is a platform aimed at collecting maintaining and disseminating information about discovered
vulnerabilities, targeting real computer systems.
The database will customarily describe the identified vulnerability, assess the potential infliction
on computer systems and the workaround required to desist a hacker.
Now here are the most known vulnerability databases. Open Sourced Vulnerability Database (OSVDB) was an
independent and open source database where all of the project was to provide accurate, detailed, current
and unbiased technical information on security vulnerabilities.
The project promoted greater and more open collaboration between companies and individuals.
The project was started in August 2002 at the Blackhat and DEF CON Conferences by several industry notables
On the 5th of April 2016
the database was shut down. Although the blog will continue.
The National Vulnerability Database is the US government repository of standards based vulnerability
management data represented using the Security Content Automation Protocol (SCAP) this data enables automation
of vulnerability management as well as security, measurement and compliance. NVD include databases security
checklists, security related software flaws, misconfiguration, product names, and impact metrics. CVEdetails.com
is a free CVE security vulnerability database/information source. You can view vulnerability details, exploits,
references, metasploit modules, a full list of vulnerable products and CVSS score reports and vulnerability
trends over time. CVE, Common Vulnerabilities and Exposures
is a system that provides a reference method for publicly known information security vulnerabilities
and exposures.