Instructor: Welcome back.
And in this video, I want to show you something
that you will do every time you perform a penetration test.
I want to show you how to manually search
for vulnerabilities.
And this is something that you will do a lot.
You will use this more than any other tool that we covered.
So, what manual vulnerability analysis is,
is us simply Googling the vulnerabilities.
For example, suppose we are attacking a target.
And right here, I just performed the version scan
for the Metasploitable.
Imagine Metasploitable is our target
and we just performed this version scan.
We got these different ports open and different versions.
How do we know if they're vulnerable without using any tool?
Well, what we can do
is we can copy the name of the version
that is running on an open port,
then go to Google,
and just paste that name
and add exploit.
And here it is.
We're already getting some response back.
Python exploit for this version,
which is the exact version
that our Metasploitable has.
VSFTPD, the exact version that we have.
Backdoor Command Execution.
And what you would do
is you would just go to these links
and try to find the exploit for it.
Down here we already see that an exploit already exists
for which platform it is.
We can see right here the source code if we want to.
And here it is,
the exploit is coded in Python in this case.
And this is how you would do
most of your vulnerability analysis.
We also get the Module Options,
and what this Module Options are
is something that we will cover in the exploitation section.
This is how we can exploit the target using tools.
We are going to cover that shortly.
For now on,
This is the way that you can find out
how to exploit the target.
You just go through bunch of links
and see whether someone already came up
with the exploit for that specific version.
In this case for the vsftpd 2.3.4 version.
And you would do this for any version that you discover.
For example, you can go right here, Apache httpd,
and copy the version.
Make sure that you copy the number as well
which in our case is 2.2.8.
Then go and paste the name of that version.
Add exploit,
and here we already get the output,
Security vulnerabilities.
If we click on it,
we can see all of the vulnerabilities
that this version of Apache has.
Right here, we can see which score they have,
and the higher the score, the stronger the vulnerability.
Right here we can see the vulnerability ID,
which remember from the last video I told you
this format is used for vulnerabilities
and you will see it a lot,
and we can see all the vulnerabilities that it has.
This one particularly,
we are really interested in, why?
Well, because it has this score, 10.
That means that it is a really strong vulnerability.
Most likely execution of code
or remote access to the target.
And it indeed is,
it says right here, "Code execution."
And if you click on it,
you can see what this vulnerability does.
You can see confidentiality impact is complete.
Integrity impact, complete.
Availability impact, complete.
There is a total shutdown of the affected resource.
The attacker can render the resource completely unavailable.
So, this also seems like some kind of a DoS attack.
And down here,
we can see that this will most likely work only for Windows.
As I'm noticing,
Windows right here a lot.
Windows right here,
Windows right here.
Now, of course,
you would read through this a little bit more detailed
but for now, this doesn't seem as an exploit
that would work on our Metasploitable.
Because Metasploitable is running on Linux,
and this is what you would do most of your time
researching for vulnerabilities.
This is how you find them,
and then you search for the exploit created
by someone else that you can use to exploit the target.
Another thing that you can do is you can use a tool inside
of the cal Linux called searchsploit.
And searchsploit, if I type --help,
simply takes the input of the version of software
and then it searches through cal Linux database
through all of the exploits that cal Linux has,
and tries to find an exploit that will work
for that specific version.
Right here we have some usage examples.
But with a need to perform these complicated commands,
all we can do is copy for example, some version.
Let's say we copy this version of software
UnrealIRC and copy this.
And what we can do once we copy that version
is type searchsploit,
and then paste version name and we get the result.
It'll tell us right here
there are already some existing exploits for the UnrealIRC.
We also get which version are the exploits for.
One of them are Backdoor Command Execution.
The second one is Local Configuration Stack Overflow.
We also get the Denial of Service exploit
and on the right side,
we get the path to those exploits.
Right here, this one is under Linux remote
and it is named 16922.rb.
And this rb simply stands for Ruby.
This is coded in the Ruby language.
One of them is for Windows,
one of them is for Linux.
Since we are running Metasploitable,
we would only be interested in the Linux exploit.
So, let's try to navigate here how we can find this exploit.
Well, we can copy the name of the exploit
and use locate command
to find where exactly this exploit
is located on our machine.
And it is in this path right here.
So, you can copy to this directory,
cd and then paste the directory name.
And if I were to nano 16922.rb,
this will open an exploit
that we would use to attack that UnrealIRC open port.
As we can see,
it also tells us that this is a backdoor program.
This file is also part of Metasploit Framework.
And Metasploit Framework is one of the biggest tools
that we are going to cover.
In the next section,
we'll cover all of the basics of it
and we will also cover how we can run exploits
and attack different machines
using this Metasploit Framework.
Okay, cool.
We found an exploit for this specific software
using searchsploit.
So, now we know we got exploit
for that version of software that we have
on our Metasploitable.
So, this is usually how you would perform
most of your vulnerability analysis.
You either use tools like searchsploit,
or you manually try to find an exploit on Google
to see whether anyone has exploited it before.
And if they have, how did they do it?
You will also use Nmap scripts sometimes,
but I personally rarely use Nmap scripts
for vulnerability analysis.
And the last tool that we are going to cover
for the vulnerability analysis is going to be Nessus,
which we will see in the next section.
That tool is huge
and you will use it a lot in your vulnerability analysis.
See you there.