Lecture "Penetration testing: Finding vulnerabilities" provide students with knowledge about: Nmap scripting engine; Web application scanning; Metasploit; Manual analysis. Please refer to the detailed content of the lecture! | Finding Vulnerabilities Contents Nessus Nmap scripting engine Metasploit Web application scanning Manual analysis 1. Nessus Nessus Tenable Security s Nessus is one of the most widely used commercial vulnerability scanners though many vendors provide comparable products Using TCP port 8834 root@kali service nessusd start Nessus Nessus Nessus Nessus Nessus ranks vulnerabilities based on the Common Vulnerability Scoring System CVSS version 2 from the National Institute of Standards and Technology NIST . Ranking is calculated based on the impact to the system if the issue is exploited 2. Nmap scripting engine Nmap scripting engine The available scripts fall into several categories including information gathering active vulnerability assessment searches for signs of previous compromises Nmap scripting engine nmap -script-help Nmap scripting engine 3. Metasploit Metasploit scanner modules Metasploit can conduct vulnerability scanning via numerous auxiliary modules. These modules will not give us control of the target machine but they will help us identify vulnerabilities for later exploitation Metasploit exploit Check Functions Some Metasploit exploits include a check function that connects to a target to see if it is vulnerable rather than attempting to exploit a vulnerability 4. Web application scanning Web application scanning Nikto Web application scanning Acunetix Web Vulnerability Scanner 5. Manual analysis Manual analysis Exploring a Strange Port
