Hello everyone. Welcome to another video from section 1001 level
T on it. In this video. I'm going to go an overview and
vulnerability scanning and talk about
how it's working exactly way when edits and what are the benefits
of that. Some other tools that we can work on exactly to,
you know, one another to scanning. So we can
ask and answer a few questions. So
what is
Pull up with his Cannon used for, and, for example,
or more important than that. What is wrong with this scanning? So,
it will be scanning assist of
possible, security, vulnerabilities and computers networks, internal
and external servers, and communication equipment
that cyber criminals can exploit. So anything, that's
when we hacked one of these can can assess
of possible security, one level design that so is
automated activity desk, an instructure targets such
as an IP addresses from now on the abilities and
And these configurations for sure or Miss files or anything
that could at least two dangerous activities from
dementias activities?
So the result, one abilities and resulting of
that assessment reports will help you properly identify
the security weakness that need to be resolved, in your
computer, or in your server, or your network.
So what is one level discounting is
for unlimited? Scanning is an essential part of education
for your organization's security Risk
by using a vulnerability scanner to identify the
points of the weakness in your system.
So you can reduce the attack surface that criminals are
hackers much played focusing. Your security Force
Under areas that are the most likely to
be targeted. For example, the
services that we talked about a lot in a scanning
SMU servers, the active directory is
to one of these cans can also help to
routinely audit IP, address range to see
if on a trial, services are being exposed or whatever.
Any IP addresses are being used. So,
Example, imagine that your server. We
have some lots of eye peas in
your company. So when you find out one of the IPS in
your server using unnecessary and another tries
serve on a try Services, that's where
you found that okay. Something's not right here, and we need
to stop that.
So how one load is scanning and testing exactly
work, there are two main type of vulnerability scanning.
The first one is a notification scans
fire. Will find weaknesses in
your security perimeter, but second one
authenticators cans is privileged credential
to go further and deeper in your systems and
server finding security weaknesses and misconfigurations in
your internal Network.
So, whichever type you choose for
promises, think you
will use reference database of now. Flaws coding
bugs, any of us
were available or any type of functionality that are
available in exploitations.
Or configuration errors and potential routes
into a corporate networks. That attackers can exploit for
sure. And these details are updated continually. So it
is very important to use and updates. One
of the testing tools because database getting
audited every day and we have a lots of
updates every day. We have a lots of the exploiters coming
up every minutes. So it's very important to
bring an update in this field.
So, I mean not that because one of the most important things, if you
have one to save your job, maybe a company, you should
be updated. So why is exactly important
to us?
Only booties and white spreads across a
organizations of all sizes. New ones are discovered
constantly or can being produced as
a result of the system changes hackers
criminals. And anyone who want to harm your systems
use automated tools to identify and
exploit now on the abilities and access our secure systems Network
or data or some of them would or professional
trying to use it handy. Try to find a school injections. Trying
to find
Exercise in accessibility is in your
website. So by having it acknowledge that
you have, this one level this in your web servers, in
your servers, in your nude for his new computer. You
can try to stop them and stop getting
hacked by it and start getting measured outside
world exploding on level this
without a media tools is simple example. Attacking our
cheap easy to run and next next
click on next. So every internet racing
transition is as race sea.
So, for example, anyone that have experienced
would hacking with a calisthenics, try to have
knowledge in the vulnerabilities, trying to bring can attack your server.
The type of web servers easily. All
it takes is a 11 ability for attacker, our
hacker to access your network, access your servers and access
your data. So this is why applying
patches to fix these security. More levels is essential. If
you don't update your software firmware on
pressure system to the lastest version that
That they have released from that. The only reason your
system will remain exploitable and leave your organization, and
you risk worse than that, in a
worst-case scenario. As your engineer. We should
always have worst case scenario. The vast majority of
instructions that are not discovered, until it's far too
late. So for example, if you
have firearm and dates Trend reports, and
if you search for that, you can see how many
Global medium you will time between the start.
A cyber instruction is in the identification between of
56 days. So when they hacked after
56 days of find out, oh my God, we
just get hacked. It is those hoping that
we call it trouble and Cal disaster in
a cyber security in a company. So,
unimaginable levels is scanning tools scam for
open ports and detect Commons as Services running of
the port's, something like we did a mind map.
The identify any configuration issues or
other vulnerabilities and new services and
look at their whatever the best
practices being followed such as the use of the TLs version,
1.2 or higher and
stronger. Ciphers. And one of the scanner reporter is
the generator to Holiday item
that you have an undefined. So, for example, when you
work in a company, your manager asked
you to give a report about the
Service, service, security order on the ability that we
have now or something like World scanning. So you
should know how to turn to report. How was reporting? What's
important things that you should mention the report by
acting on these finding an organization can
improve its security purchase. So, welcome.
Dr. One of this kind exactly. It Department, usually
undertake one level. It is scanning if they have
the expertise and suffer to do so, or they can call
on third-party security services provider like I to
Silence. I think governance is camera conductor, non-target the
decline of necessary permission to have scanned and
a users of the services are required to confirm that
they have use permissions. When this cans are also
performed by attackers whose per the network and
internet to find a points to of entry into
the system and networks. So, for example, we have bug bounties that
they get paid to. If you find anything we
have the, it Security Department in a network. We
have third parties teams. So we have a good
coach.
Here that says how often should you conduct them?
All of this getting so it's very important based on everything.
We said, how often should we try to
provide a forum messages scan trying
to point out? How when we start exactly and
where we stand as cyber security work. So
well in scanning to be conducted regularly, to
ensure that new one level. It is our identify as
soon as they become common knowledge, and that appropriate remedial
action or taken such as applying a
three patches to the fix. Our vulnerabilities Furcal
security is Cannon can show where exposes services
are on patch and 172 explosions. Allowing
it team or security team to take these switch
remedial actions. Also, you
should have a vulnerability Management program. This
should include a scanning and least monthly once
a month and an old printer and testing as
well as when you to make changes to your system. And actually,
it's based on how important data you.
Of how business you arrive. For example, if
you run a big - thanks that's conclude. The lots
of user data set, you have issued to do to two
weeks, one day in your two
weeks, or try to monthly to us in a monthly, because
it's very important to you because you have the users data
users information and actually responsible for
that. So this will help identify your security weaknesses
and extent to, which are you? And how
is going to be a attack or are you exposed to
be at?
Tag or you want level to the cyber security or not? So
when you ask, what is the difference between the vulnerability
scanning and pressure testing when we saying that
we should have them for example, once a month and another one. So move
again. So multiple scanning is at home, automated
process that identifies your server, security weaknesses, but
pension testing goes. One step further involves
the peripheral ethical hackers combining, the result of
that formations can with your expertise to recover vulnerabilities,
that may not be on it.
By Scandal, own Pinterest, has
we also take your environment into accounts a
significant factor in determining what level tis.
True say, well, gee, I'm grating or downgrading. This court
as appropriate. We have three type of them from
then. We have white box. We have black bug and we have great bucks. They
also identified a false positive. We're scans have
identified a weakness that it do not exist. So
we were up that sometimes you find them all the good teacher at
report on what actually is a false positive.
If you're sure that you do not waste resources securing
part of your eye structure that are not safe
from Attack. So as we are in a kernel, virus
word, and in this era, we need
to work remotely. So I hold
one level to scanning and remote working.
Identify an image gracious security. One level
dick is especially important when a staff work from
home. For instance. When you connect to the internal, we
are home. Network security feature that you usually take
for granted in the office, just filtering firewalls
and encryption may not be available. And
I want to stab use their own equipment known
as beauty or bring your own devices to
connect to that Corporation Network. You will have
less control over the configuration.
After security setting for sure, keeping your
we p.m. From the company software up
to date, is also essential to ensure that staff have been
secure remote access to occur operating system. So,
may you don't have a company or don't not
working with a company. And you may ask cannibal images
can inhale value. If I want abilities on my website, personal
website content answers use for sure. We
have some websites itical hacker try
to do face or hacked the website and exposed.
Formation. Try to make a resume for all cells trying
to make facts for themselves. So may you
website one of the targets? So if you about
your business personal business, purpose of personal
information, you may want to do that, because it's very important
to keep your data safe. And actually, we
are going to make the word and
cybersecurity and internet actually
safer.
Before heading up turkel Linux. Let's show
some good quality scanners tools that
you can use. So let's check our website. The first one
is
Comics.
This tool actually could perform a good one of the scanning for
you and you can actually get a demo from them. Find
what other scanners can do. Let's see how
Connex tried to promote himself
to take over 7,000 vulnerabilities,
including School injection, exercise, misconfiguration. We
password expose with your base and out-of-band. One
abilities using warm look like
We have advanced in Mark, recording, scan, all
pages web pages. So as you
can see here connects is one of the good ones I
use it before. It's good. Sometimes give
you a false positive. But actually it's try to the best. The
next one is actually very famous is
Sis.
So we can go to the website here. Is it
the turntable? And the product is an assist
so we can actually have a free download here.
That's try to give you some scan 16 IPS.
That's the demo one. But actually you
can buy one for your personal use or
business. Use is a very good
one. I use it before it's so very trustful and
I can't tell you how much is a good exactly so you can use it
or use a free demo. We have another Spark.
Okay.
Here's it.
Then a spark.
This one is actually not bad. I tried before. So
if you want to rate a tennis, which is the first one I
use and it connects is the second one, and this one is
going to be the third one, maybe.
You can get a demo also here.
Supposedly the one we're looking for. You can get a
demo here exactly. Same output. The
like connects.
So, what am I doing? Security truth? You'd see DLC, try
to promote themselves and all the features
is going to give you and
Yes, whatever. You want to decide what a price and your
actions. Which one is the best
for you? So let's go track a Linux. All right, we're in callanetics. So
going to K, looks actually we have one
topic says one live internalizing and
try to give you some good features about
that. We will do Liza's and we have
web application analysis. So we need type, click on
it on the melting ice. Has we have actually
Fear of one of the scannings, for example, we have
another we work for and we have new tools clip and nectar. Let's
see what happens next. Okay.
There's a nikto.
Configuration.
So Percy can now configure your
configuration file as is, you may want to
the format's plug-in and reroutes everything
that you need to. We have also.
For example in a web application analyzes or
on the within Eliza's. We have - we
have a map that we use to work with it. We have over and
open Where's that is also a good one that
you can work with it so we can first initial
setup and install it and start working on it. Also,
we have some good Tunes
in with a vacation license such as bread first. There
is one very useful. That's also have a lots of
things at doing the crew. Require them to
Right curse word. We have a school map.
This is also very good. We have a scan that
is useful for the WordPress website. We
have Zapped, we have is crap. So we have good tools
actually in that Kalyn example. Well, so you can scroll them
and work with them. Try to see the hard disk on that or try
to use a man comment to find out how its work. Exactly,
first week. We found what
we call in here. And what I'm going to do, try
to explain about
vulnerability, analyzes and vulnerability testing. Try
to set a difference between British just saying, animal ability
is as men's also introduce some
tools to you to you know, I'm
here to improve your knowledge. Try to engage yourself with
that more important roles as well. The
next video. I'm going to talk about exploding real. We
NC. Good luck.