This is a really fun course.
We just covered vulnerabilities, what
they are, some case studies looking at Heartbleed,
EternalBlue, and Log4J, examples of how we can look up
a vulnerability research, what it means, what it can do,
why it matters.
All of this is great for you to understand no matter
where you are in your cybersecurity career.
If you are going to be a penetration tester,
understanding these vulnerabilities
and how you can explain them and sell the need
to mitigate and remediate to your clients in your report
is huge.
Understanding what the possible business impacts to them
are huge.
We had some labs where we looked at Nessus,
how we could utilize that to find vulnerabilities
and maybe even have some proof of concepts,
some ways of exploiting those to show how an attacker would take
advantage of those things so that they fully
understand what it is that they are vulnerable to.
We also did that with ExploitDB and our vulnerability research
lab, and hopefully now you have more tools in your toolbox
to utilize to find vulnerabilities, research
them, and then apply the exploits in a useful way.
You should be able to describe vulnerabilities, recognize
the CVE and National Vulnerability Database
submissions, understand non-technical vulnerabilities--
again, people and infrastructure and the physical
can also be vulnerabilities.
We didn't research those, but we did talk about them.
You should be able to describe vulnerability management now.
So understanding that the company, while you've
shown them these vulnerabilities,
it's up to them to decide how they're going to utilize them,
how they're going to take that information,
and what decisions they're going to make
based on their business case.
You should be able to now do some network auditing,
utilizing Nessus and Nmap, and perform vulnerability research.
It is more than just Googling and following a rabbit hole.
It is knowing what it is you are looking for.
ExploitDB is a great place to look
at the National Vulnerability Database and the references
there--
great places to look.
They will lead you toward finding useful information.
They're not the end-all, be-all.
There are other places, but that's good for now.
And with that, I will leave you, and I'll
see you in the next course.