Finding and remediating system vulnerabilities in this video we will take the information we learned
about our target hosts in the previous video and use a web resource called exploit D-B as well as a
built in Cali tool called Search boyt to find potential vulnerabilities.
We will also discuss at a high level some ways to remediate these vulnerabilities as you get more familiar
with the scanning results and map at some point you'll naturally want to search for additional relevant
information such as if the software and operating systems discovered on your network have known vulnerabilities
in that respect.
One of the best sources I can point you to is exploit D-B dotcom.
It's maintained by offensive security.
The same folks who managed the Kalli Linux distro.
It's been around since 2009 and is updated regularly to get started on exploit D-B.
You can just conduct a simple search with what you're looking for.
If I use my end map results as a starting point I might be interested in what vulnerabilities are out
there for DNS mask so I can just hit the search box and type in dnsmasq.
However I've got to fill out some captions before that search completes which can be a bit annoying.
But once the capture requirements are satisfied I can see the results of my search which contain a handful
of vulnerabilities for various versions of DNS mask.
That's cool.
But notice if we try to do a search without checking the I'm not a robot box the exploit D-B site offers
us an alternative way to find vulnerabilities via search split a command line to a built in the Kalli.
Let's take a look at some of the basic features of search.
First let's update search Blits database by running search space Takk you then we can conduct our first
basic search which is just the search command plus the term you want to search for.
Now notice in our results that we get the title of each vulnerability followed by the path to the script
or program on our local harddrive.
If we'd rather see the or L associated with each vulnerability we can repeat our search with the TAC
w flag.
And we can see now how the local path of each vulnerability lines up with its online counterpart
another nice things search it can do is make it easy to launch an associated script by copying the file
path into the clipboard for us.
So if we do a search Boit search with the TAC P Flag and then specify a vulnerability like 4 2 9 4 6
we'll see that the path is now copied to the clipboard.
So now we can just type python and paste in the path of the exploit script and we're off and running.
I want to show you one other handy search Boit feature that can leverage an output file from Unmap.
Now don't worry if you're unfamiliar with the context of the map command you're seen as we'll go more
into exporting data out of map in future videos.
All you need to know for now is that I'm adding a flag here to export and SML output of my scan and
then once that scan is complete I can run search ploy with the tac tac and map flag and then pointed
to the output SML file that was created.
Once we do that the output gives us specific search commands we can run to search for vulnerabilities
based on the versions of software detected in our maps scan.
So in the future you might want to write a script that scans and network with and map saves the output
to a file then checks the file against search its database to find potential system vulnerabilities.
This can help you identify unpatched or vulnerable systems more quickly and boost the overall security
of your network.
In our next video we will troubleshoot some common issues that can arise during our network scanning
operations.