- For vulnerability scanning, we're gonna break this out
into network vulnerability scanners and
web vulnerability scanners.
You're probably gonna use a mixture of both
in your engagements, so we want to cover everything.
Let's start with the network vulnerability scanners.
OpenVAS, free open source, it's a great tool.
We're actually gonna demo this so you can see how it works.
Nessus is one of the defacto standards in the
vulnerability scanning industry, but unfortunately
it does cost money, as well as Nexpose and Qualys.
Those are all popular vulnerability scanners
that cost money.
So if you do not have the resources, you want to try
something completely free, OpenVAS is your tool.
If you're using it in a professional environment,
you probably will end up stepping up to one of the
more professional versions because of speed
and for efficiency.
The Nessus and Nexpose and Qualys tend to give you that.
There's also Nmap.
We're saying Nmap here for a limited vulnerability scanner.
We covered it previously.
You can see how it's an amazing port scanner,
but it also has some limited vulnerability scanning
capabilities as well.
There's particular vulnerabilities it can actually scan for,
and it can let you know that these systems are vulnerable.
There's numerous Nmap scripts which we'll cover
in the demo section.
For the web vulnerability scanners, Nikto is an all-time
favorite, it's been available for years.
It's an easy-to-use web vulnerability scanner,
which we'll cover shortly.
WPScan is a web vulnerability scanner that is specific
to WordPress websites.
There's also SQLMap, which is for penetration testing
on databases and doing SQL injection on websites,
and so it's a really good tool for actually doing
SQL injection and clearing these databases.
Burp Suite, which will be covered in the web application
penetration testing section, it is one of the standards
in penetration testing, web applications.
It's probably one of the most popular tools,
if not the most popular web vulnerability scanner suite.
So, it does have a scanning section to it, but it is an
overall web application proxy as well,
so it has a lot of functionality,
but there is a vulnerability section.
The same with Zed Attack Proxy.
It's similar to Burp, but it's completely free.
It has vulnerability scanning portions of it,
but is also an overall proxy that you can use
to test web applications.
So now let's look at the Nmap script engine in action.
So we looked at Nmap as the port scanner before,
but you can also do some vulnerability scans
with Nmap as well.
So we could see, if you just type in Nmap by itself,
you see all the command line options, the dash SC
is the script scan.
There's a whole list of scripts that you can run with Nmap.
And that is the script scan functionality.
We'll see exactly what that looks like though.
So if you go to the user share Nmap scripts folder,
that is the list of all the Nmap scripts.
So you can see there is a large number of scripts
that you can run on your system, run against other systems.
This section right here, you can see, shows various
smb vulnerabilities that you can scan for
in your environment.
There's a lot of different ACP vulnerabilities
that you can scan for as well.
The actual full list of Nmap scripts is on the Nmap website,
and it's broken out into different categories.
You can see it's the NSE doc part of the website,
so there are vulnerabilities, there are scans for malware,
there are intrusive scans, there's exploit scans,
discovery scans, of course.
But we're going to count straight of course on the
vulnerability scans.
So looking at the vulnerability scans,
there are a lot of different vulnerabilities that
you can scan for with Nmap.
We're gonna concentrate on the smb vulnerability from 2017,
which is actually the vulnerability that the
wannacry ransomware and the petya ransomware exploited.
So what's really neat about this is,
with Nmap, you could scan your entire network
to see which machines are vulnerable
to this exploit.
So without even using a full-blown vulnerability scanner,
you can just run a couple of command line tools
to actually scan your entire network very quickly
to look for vulnerable systems.
You can see you download the script right
from Nmap's website, and you can download it into your
Nmap script's directory.
And it tells you exactly how to run the command.
You run Nmap on port 445, which is the smb,
and you do dash dash script, and the script name,
and then the target systems.
So you can put specific systems in there,
or you can put entire networks in there as well.
So let's copy that and run it against one of our systems.
I'm gonna run it against 192, 168, 3.19,
and we can see very quickly that the system
is vulnerable to that exploit.
So you see 3.19, you see it says it's vulnerable
and critical remote code execution, vulnerability exists.
This is one that you can patch using your regular
Windows, Microsoft patches,
but it's really handy to quickly scan your entire network
with Nmap looking for this vulnerability.