7. Vulnerability Scanning

process of identifying the attack surface

automated scanners exist, e.g. nessus or nmap

standard process:

1. host discovery

2. port scanning

3. os, service and version detection

4. checking against vulnerability database

false positives and false negatives

automated scripts might not adapt to the situation of the current target

authenticated: get credentials, user perspective

unauthenticated: no credentials, external perspective

internal: scanning the internal network/machine

external: scanning public-facing services

commercial tool

templated scans which can be modified

• e.g. scan for specific CVE on host

also authenticated scans against hosts to list outdated/malicious software packages

NSE scripts located in /usr/share/nmap/scripts

there is also a script.db file which specifies the categories of all scripts