Welcome back to the official Start COP series for the certified 2010 Tester.
This is going to be the vulnerability assessments module.
We're going to talk about vulnerability assessments.
We'll talk about the various tools to conduct vulnerability assessments.
And we'll also look at different ways to analyze and prioritize vulnerabilities.
So this is a headline.
Our Table of contents.
So we're gonna talk about vulnerability assessments.
We'll look at the different types of vulnerability scans.
We'll look at the different tools that are used for vulnerability scans like Nessus, open, bos, nikto
and even.
Some tools for scanning services like WordPress and Juma also look at different countermeasures.
For vulnerability scans as well.
So this is a chapter for we're looking at what are vulnerability scans, different types of vulnerability
scans.
We'll look at Nikko, the web marble security scanner, we'll get WP scan, DOOM, scan, open VOS and
CMS map.
So it is a vulnerability assessment.
So it's really the process of defining, detecting, categorizing and prioritizing vulnerabilities in
computer systems or information systems, as well as web applications and even network devices.
That's all with the goal of providing an organization with an assessment that they can use to drive
their different security strategies and also help enforce a certain level of security.
So if the organization does not do proper viability assessments in vulnerability management programs,
then they will be at risk for hackers and ethical hackers.
Based on the software, hardware or other systems they have.
There are many different ways to do vulnerability assessments.
Vulnerability assessments may be done.
As part of a larger scale compliance program.
So let's get into some of the tools and some of the different vulnerability types.
So we have network based more ability scans.
These are used to find vulnerabilities that can be exploited over the network.
Usually vulnerabilities come out in two flavors, either local or remote.
They're also post based more abilities.
So things like servers, workstations and even switches, routers and all that kind of stuff.
Then of course, we have to look at wireless networking, so we have to look at the organization's Wi-Fi
posture.
If there is Wi-Fi allowed or maybe there's a guest wi fi or some commercial wi fi platform, these can
be targets of attack through rogue access points and many other attack vectors.
We also, of course, want to scan applications that are running on websites because websites are not
largely static anymore.
They're very dynamic with Java based websites and even flash in some cases the flash is becoming moving
towards being retired.
And then of course, we have the databases that hold those precious confidential or maybe proprietary
information, the crown jewels, if you will, of your company.
So if you're a online retailer, your database may be the most important thing that you have because
it holds all your records of your inventory, your clients, your customers.
And so their databases are vulnerable to things like SQL injection or command injection, any kind of
attack that allows me to, as the attacker or an ethical hacker, to run commands on a database that
maybe it wasn't intended that by the creator of the database.
So let's all get nicked.
So first off and we'll talk about just where to find these vulnerability tools and Kali Linux, let's
open up our virtual machine here and we go to the start menu.
We've got a whole section.
It's actually the number two of vulnerability management tools.
Notice we have Nikita as well as End Map.
There are other tools that are in there which we don't have time for, but there are many different
tools for vulnerability analysis.
They even have they put some of the tools under the web application section like one map and WordPress
scan, but that's only because they typically are volatility assessments for things like websites now.
There are many other tools besides this, so take it with a grain of salt and understand that there
are lots more tools than just these that were being presented here.
So Nektar is a web scanner that addresses web service for dangerous files, malicious common gateway
interfaces or cages that are outdated, maybe unpatched servers and other problems.
So it runs more than 6700 different tests, so that apply to various different server types.
And so there's even a few variations of Nextel that run on Mac as well.
And so, Nito, just keep in mind that it's not stealthy.
It's not a tool that's going to it's going to set off some alerts.
So let's go ahead and open up a command prompt or a terminal.
Since we're dealing with Linux here and we're going to go ahead and look at the main page or the manual
page for Nick to.
So we want to scan a web server for known vulnerabilities and look for potential problems like default
files and secure files.
And Nicole has many different options.
It can also display HTP redirects.
It can look at cookies that are received.
It can show any 200 responses.
We can also set it to verbose.
Let's go ahead and just run it on the local post here because we should still have our Apache server
running.
And because of that we have to pseudo.
The Apache is not currently running.
So let's go ahead and start that with the Apache Controller Command and Apache should be.
There we go.
It's now running.
So let's go ahead and do Nikto Dash H.
And we can see the help information.
We can list plug ins.
So this actually requires an argument.
So let's go ahead and do the H local host.
And we're also going to do the V for verbose node.
So let's put in.
What are our actual IP?
I totally forgot in the process of doing this.
192107.205.
Let's try that again.
We have a difference.
So it's still saying it's an invalid IP.
So we'll go to get that fixed.
And we'll be right back.
So we'll go ahead and run a scan on another machine on the network that I do know has a Web server running
or will actually go ahead and enable on this local workstation as well.
On the same subnet, I'm using the X a temp web server, so I'm going to go ahead and start Apache and
my school and file Zilla.
So I'm going to go to 7.2 23.
Let's make sure we have a network connection just to be on the safe side.
There we go.
So I think the dash V was the problem.
That does happen again when you don't work with these tools.
Again, I say this all the time.
You want to make sure that you use the man page and these tools can change.
Sometimes switches will change.
Notice it's already found the type of server and this happens to be Microsoft ISC server, Internet
Information Services, and it found some vulnerabilities.
So we could actually take this and write it to a file.
But that's a basic run of Excel.
And if you don't have any other vulnerability management tools, it is a great option.
We're finding out quickly what's going on with that system.
So Nektar has proxy support.
You can save reports in plain text XML and even has several templates.
So if we want to.
Test on different websites.
Let's go ahead and.
See some other things we can do with it.
So we went ahead and reran the same query with the verbose mode.
So basically it's going to show all the different web tests it's going through.
Again, it's a lot of data coming across the screen right now, but it tested a host and it actually
did over 7000 requests made.
And we can actually cat.
Yeah.
So to look at.
To look at this.
We're going to set up basically a simple web server.
Clear the screen.
I call this in Python.
It's a simple one show that will actually serve up local directories.
Now let's look at a tool called WP Scan.
MP Scan is for scanning WordPress websites and obtaining vulnerabilities within the core version.
Any plugins you might have.
In addition, it can also look for weak passwords and other security configuration issues.
So it'll look at your robot's text file, your debug log, if you have that many changes that were made,
and so on and so forth.
So we go to our Web application analysis tools.
We have our WP scan or WordPress game tool and it's going to execute the Help file if you just click
on it.
And that notice there's the.
Version.
You can put verbose mode.
You can.
Output to a file just like you can with many of the other tools.
You can enumerate.
Look for plug ins that are vulnerable.
On a particular WordPress site.
So that was just a partial list.
If you if you do the two ages, you get a more detailed list of options.
So there's a lot of tools built into every piece.
And of course, you don't want to use this on any sites that you don't have permission to.
And it's a very powerful tool for finding vulnerabilities in WordPress websites.
So you can run the.
Never scanned RV and then the URL to look for vulnerable plug ins.
You can enumerate vulnerable themes.
And you can also check for users as well.
Let's talk about June scan.
June scan is a vulnerability enumerator numerator as well or the Joomla.
Webb's platform.
So June scan is not in the CALLIE installation by the fall of 2020.
But you can do just an app dash get install.
Of it and you'll it'll download it see it's already download the first pseudo to root
and see where it's on the latest version 00.70 and install the necessary perl libraries for it to be
able to work.
Let's go inside the screen and there's no manual page for this program.
But there is a health file.
This is another hospital.
If you want to enumerate a system that you know is running Juma, which you could you can go out and
find vulnerable Joomla websites with Google Dorking of course and your.
You can also run it from behind a proxy.
So essentially the command looks like this.
Jim scanned dash, dash the URL and the website you want to scan.
Now let's look at a tool called Drew Poem.
This is a.
Play on words.
Of the Drupal system.
So DuPont has two separate modes enumerate and exploit.
So with enumerate mode, you can enumerate files, you can enumerate what modules are running and even
what themes, and it actually allows you to exploit vulnerabilities with it.
So let's switch over to our call box.
And we'll open up the terminal.
Go and see the roots.
And
DuPont is not in the calorie repository.
That's one of the first things you'll see.
So you have to essentially.
Go out to its GitHub site and pull down a copy.
Sometimes these tools do get.
Updated.
Sometimes there might be a long time before they get updated.
So this is the the GitHub repository.
Z version 1.0.4.
And it's been tested on version seven and eight.
So again, it may not be able to do all systems.
And the installation you have to.
Call it from Python as it is a Python tool.
So go ahead and grab the link or get I will get clone and we'll paste the.
Like in their.
All right.
I'll go ahead and look at the read me file.
So.
This can also be run from a doctor container.
As an alternative.
There's basic usage commands and then there's the installation.
So.
First we got to run some commands.
How to run the required commands to make sure that everything installs correctly for the screen losing
tip for this one.
So it's collecting a few things that it needs to be able to install it and it's finished.
So now.
There's the Help file.
You pick the mode, there's the the hostname, the target, the go after enumeration.
And of course, you could use Google Dorking to find out a system that's actually running Drupal.
And there you go.
Now let's talk about Open Vos.
Open Vos is best for doing hard reality scanning, where manual scanning would be a very time consuming
and tedious process.
Now calling Linux the old version that used to have open Vos when it opened.
Vos is a actually a fork of Nessus, the NASA's marble scanner.
So in a02 route.
And usually would go out to app get install open Vos and it's going to have to download a whole bunch
of packages or to be able to install.
You could go to this synaptic package manager or something like that.
You can see that open box is not there by default.
Open box is actually called the The Green Zone.
Scanner.
And if you want to get the community edition for you or some other system, you can go to this website,
green bone dot net.
And they do have a pro version.
You can also run it in a virtual machine as a separate system itself.
And they also have a test, a live demo.
So they have other solutions too.
But we just want the community ignition.
And they do have various security feeds as well.
The ISO is right here.
So you download this ISO and then you can import that into.
A virtual machine.
Of course, they give you the shot to 56.
It will work with either VirtualBox or VMware ESX AI.
Of course you're going to need to have at least a dual core system for gigs of RAM.
So let's see our Open Vos interface.
It has both the command line interface as well as a gooey, much like masses.
So this will take a while to install.
This is a brief overview of some of the open VOS components.
It has a command line client which you can access to run commands as well, much like SS.
It has the web client which you run through the browser and then there is the open vos manager daemon
and Open Vos works off of a skill like database and then it has something called the MVP, plug ins,
network vulnerability tests.
These are essentially the signatures for the different abilities that are out there.
And then Open Box has its own scanner that you can customize and you can run different scans on either
discovery scans, you can run compliant scans.
Now you can do system by system more ability scans and generate reports, as we'll see here in a moment.
So MBT is a plug in that's written in the Nessus attack scripting language because Nvidia's.
Follow essentially the same pattern as NASA's.
So if you go to the open source website open last night or you can see they have more than 50,000 vulnerability
tests and it's been maintained by Rainbow Network since 2009.
So you can actually go to their site and try out their live demo or you can download the virtual appliance
as well.
As we've shown, this is the live demo site.
And it actually gives you the username and passwords is similar to what you would see on a regular network.
So you have your dashboard here, which you can customize.
You can look at some examples, scans that have been run.
These are some of these are done on in the cloud systems.
You can generate reports.
You can see what the results were.
What host Reid enumerated.
Yes, they give you a vulnerability list and then the severity.
So you can click on individual IP addresses and you can see what the vulnerability actually was.
It's a very versatile program.
You can set up different sets of credentials.
So right on here, there's a domain admin and a scan user.
You can set different permission levels, so maybe you have different groups and different roles for
your system administrators.
Let's look at the invitees.
These are all the different network vulnerability tests.
You can see 81,343 as of this recording.
And you can see you can click through and see all the different scans.
And all that, all that good stuff.
They sort by numerical score.
And it even has a common vulnerability scoring system or cvss score calculator.
So if you want to figure out what the severity level of a particular ability, it's very useful.
Our program in that regard.
Let's go see how our download is done yet.
All right.
Looks like it's there.
So then we're going to run the open vos dash, set up command, and it's going to run through it's set
up to build out all of the vulnerability tests and then we'll be able to actually start it.
It's going to go through and put all of its shortcuts.
Z notice now you have access to the menu items that were not there before.
It's want to let this let us finish and then we'll come back.
These are some of the different components of Open Vos.
It has a management protocol, a skill like database.
You can run many different scanners if you need to based on the different types of systems it has.
The ability to start, stop and resume scans.
You can even pull in from a centralized repository much like NASA's does with and the feed gets updated
on a regular basis.
It also has a command line interface that you can run on Windows Linux and you can also integrate open
source with.
S&P tools like Nagase or any other S&P.
Program.
So Open Vos uses the Open Vos transfer protocol and it always uses SSL or transport and it has some
support for the Windows management instrumentation interface.
This is the sample demo, what it will look like when you run it.
Now let's talk about CMS math.
This is a python open source scanner that automates the process of detecting security flaws for a lot
of the most popular content management systems.
The idea is to integrate this into a single tool.
So the content management systems are WordPress, Joomla, Drupal and Moodle.
The CMS map comes with Illinois.
This is the GitHub repository.
If you want to get the latest and greatest version.
You can do that.
You can also do it.
You can install it with Python if you want to be able to run it from anywhere.
So let's go over to our.
Call the box and we'll go ahead and type in C and S now.
And that is that it's not in the.
Main download the 2020 version of Calleigh amongst all the other tools that are here.
So what we can do is we can go ahead and use Python to install it.
We'll do it both ways.
So you can just see the.
Process, right?
Okay.
So there's no CMS map in their power structure.
You're going to have to do it from the GitHub page.
Make sure I actually copy that text.
You want to do paste?
There you go.
So now we've cloned it.
The second step we're going to do.
We're going to use PIP to install it.
That was the directory.
Or we can just run the Python script.
You
can look at the read me file.
Here we go.
Now it's actually setting up the team's map.
All right.
Successfully installed.
And now we should be able to run it from anywhere.
So CNN doesn't have a main page.
So there is the help file.
So if you want to run it, you pick the website that you want to run on.
You pick the type of scan you want to do.
Whether you're running WordPress.
Drupal.
You can actually set it to enumerate without searching for exploits.
Just keep in mind, this is an attack, both of you, Iran, on the system that, you know, have permissions
on.
You can get yourself in serious trouble.
So this is some examples.
So let's talk about some of the different countermeasures that are out there.
So.
We know that the bad guys or the.
The non ethical hackers can search for vulnerabilities and exploits and be able to.
Do these things, just like we can see ourselves as ethical hackers.
So that what you want to do is you want to set up your firewalls and your IDs and your security appliances
to block these types of probes, like from tools like and mapping vulnerability scanners.
You want to filter out any unreachable messages.
So if somebody tries to send a ping or ICMP packet to see what is there, you don't want that information
to get out that you'll tell that to.
How your firewall to filter that out.
You always want to make sure that you're if you're using a firewall, make sure that your latest service
pack is installed, make sure you've installed anti spoofing roles.
So if you have spoofed IP addresses on external interfaces, those will not be accepted.
And now let's do some practice questions.
We have a question here.
This tool can detect the shellshock vulnerability and map.
PD.
Your skin or skin map.
Correct answer is B or PD.
So an end map can do some vulnerability scanning and detection.
But OPD has specific logic for the shellshock vulnerability.
Let's go to the second question.
Which tool is used for scanning WordPress websites?
So are.
I'll scan.
WP scan.
Angry IP scanner.
Or John the Ripper.
Answer is WP scan or WordPress scan and IP is more of a network discovery tool.
John the Ripper is a password cracking tool and you are also and can scan websites, but it's meant
for not metaphors specifically for WordPress sites.
Which language is WP scan written in?
Is it b h html.
Ruby.
Or Pearl.
Correct answer is Ruby.
Option as written in the Ruby programming language and before what tool that is built in the caller
limits for more abilities scanning gym websites.
So keep in mind this is not true for the latest version, but.
Older versions of Kelly did have this tool belt them.
Is it WP scan?
There are, Buster.
Sequel Map or dreams scan.
Keep in mind that the name kind of gives it away.
Correct answer is D James Tan.
Number five, what open source vulnerability scanner that is built into Kali Linux was developed by
NASA's engineers.
Nick tell.
Open Vos.
WP scan or gym scan.
Correct answer is open Vos.
So Open.
Vos is a fork of nurses and it has the network vulnerability test.
We know Nikto is the web application scanner from the command line.
If you only have one tool to use and not any commercial products or you don't have open Vos at your
disposal, you can use Nikto and of course WordPress scan and James scan are not correct because they're
for WordPress sites and the Joomla content management system.
So in summary, we talked about different processes of.
Discovering prioritizing ranking vulnerabilities based on risk factors.
Talk about the different types of vulnerability scans, be they wireless database scans.
We looked at Nick, so we looked at what PD.
We looked at Open Vos, the Nets or the network vulnerability tests.
These are essentially plug ins that are developed in the Nessus attack scripting language, and this
is a fork of the original NASA's code base.
OpenVPN is good for large networks where manual scanning would be too cumbersome.
And we talked about CMS map.
Which is a python open source CMS scanner that helps detect security falls in some of the most popular
CMS programs.
This is a summary of the topics we covered vulnerability assessments, more body scans.
We looked at some of the tools for vulnerability scans as well as some of the countermeasures.
Thank you for your attention.
Hope you learned more than you knew before about vulnerability scanning and vulnerability assessments.
It's an important part of the process, especially doing a full on pen test or red team engagement.
We'll see you in the next module.
And some may be based on different work environments.
Some might also be based on security frameworks.
Compliance frameworks.