All right, now, after gathering enough information about the target system, I think it's time, don't
you think?
I think it's time to check and detect if the target system is vulnerable.
Now, finally, we get to the vulnerability scanning page.
So in this section, we're going to discuss a number of vulnerability scanners and how they can integrate
with metastable.
Whether or not you use an automated scanner or do it manually scanning is one of the most important
steps in a penetration test is if you do it properly, it's going to give you the best value.
And what does that do?
Gives the best value to your client?
So what happens in this phase?
Vulnerability scanning or analysis is the process of detection and the assessment of the vulnerabilities
that exist within the target system.
So at this point, let's just define what actually a vulnerability is.
So vulnerability is weak, characteristic of an asset that allows an attacker or a pen tester to exploit
and gain unauthorized access.
All right.
So then what is a vulnerability scanner?
It's an automated program typically designed to look for weaknesses in networks and applications.
They send some data over the network and analyze the responses by using their vulnerability database
as a reference.
Now, because different systems behave differently when a particular network probes are sent by vulnerability
scanners.
These unique responses serve as a fingerprint that determines the operating system version and even
its patch level.
A vulnerability scanner can also use a given set of user credentials to log into the remote system and
enumerate the software and services.
Now, with the results that it obtains, the scanner presents a comprehensive report and an outline
of detected vulnerabilities on the system.
Now, that report is what's useful for you to get a quick idea and understanding of what attacks might
be worth while conducting.
However, vulnerability scanning is well known for a high false positive as well as false negative rate.
Just keep this in mind when you're working with a vulnerability scanner.
And one more thing to keep in mind, these scanners create a lot of network traffic and this huge traffic
uptick will expose you.
So if you want to remain undetected.
You might not want to use these.
But if being stealthy is not important, like we were speaking earlier, if you're working with your
client.
Then you got to do your best with vulnerability scanner's.
So I'll also highlight some auxiliary modules in the metabolite framework.
That can locate specific vulnerabilities.
So let's look through some of the vulnerability scanning capabilities at the Métis Boite framework can
provide.