2.3 Information gathering & Vulnerability scanning: Vulnerability scanning

Question 1

Vulnerability Scanning: what is it?

Answer 1

The process of assessing a computer, server, network, or application for known weaknesses:
● System weaknesses
● Report
● Recommendations

Question 2

Vulnerability Lifecycle: what is a vulnerability?

Answer 2

Any weakness in a system that can be exploited by a threat actor to gain unauthorized access to a computer system

Question 3

Vulnerability Lifecycle: what are the different attack surface - things that you can target for an attack (3)?

Answer 3

▪ Client
▪ Server
▪ Network device

Question 4

Vulnerability Lifecycle: what is the Vulnerability Lifecycle (5) and describe each phase?

Answer 4

1/ Discover: identify vulnerability, create exploit
2/ Coordinate: report vulnerability, generate the CVE
3/ Mitigate: release CVE, create patch
4/ Manage: deploy patch, test system
5/ Document: record results, lessons learned

Question 5

Vulnerability Lifecycle: what is a Unknown (Zero-Day) Vulnerability?

Answer 5

Any unpublished vulnerability somebody has discovered and has not yet made known to the manufacturer

Question 6

Vulnerability Scans: what is vulnerability scanning?

Answer 6

A specialized type of automated scan for hosts, systems, and networks to determine the vulnerabilities that exist on a given system

Question 7

Vulnerability Scans: what are the vulnerability scanning tools(5)?

Answer 7

▪ OpenVAS
▪ Nessus
▪ QualysGuard
▪ Nexpose
▪ Nmap

Question 8

Vulnerability Scans: what are the different vulnerability scanning types (2) and explain each of them?

Answer 8

▪ Credentialed Scan: Uses an authorized user or administrator’s account credentials to be performed. Credentialed scans are usually performed by the network defenders and cybersecurity analysts
▪ Non-Credentialed Scan: Conducted when the vulnerability scanner does not have valid user or admin login credentials

Question 9

Vulnerability Scans: what are the different scanning types (4)?

Answer 9

▪ Discovery Scan
▪ Full Scan
▪ Stealth Scan
▪ Compliance Scan

Question 10

Vulnerability Scans: what is a discover scan?

Answer 10

The least intrusive type of scan and can be as simple as conducting a ping sweep

Question 11

Vulnerability Scans: what is a full scan?

Answer 11

A full scan gets easily detected by network defenders and cybersecurity analysts

Question 12

Vulnerability Scans: what is a stealth scan?

Answer 12

Conducted by sending a SYN packet and then analyzing the response (= SYN/ACK, RST)

Question 13

Vulnerability Scans: how not to be detected when doing a stealth scan?

Answer 13

Evading Detection:
o Slow down scans
o Break into individual scans
o Mask true source

Question 14

Vulnerability Scans: what is a compliance scan?

Answer 14

● Used to identify vulnerabilities that may affect compliance with regulations or policies
● Example: PCI-DSS scan

Question 15

Vulnerability Scans: explain what Nmap is doing?

Answer 15

▪ A great tool for mapping out the network, finding open ports, running services, and the basic versioning of each service
▪ Nmap Scripting Engine (NSE): Conducts basic vulnerability scanning using Nmap

Question 16

Vulnerability Scans: explain what Nessus is doing and what information can you retrieve from this scan?

Answer 16

Used to scanning the target network and then create a report of the vulnerabilities, missing patches, and misconfigurations that exist

Question 17

Vulnerability Scans: explain what Nexpose is doing?

Answer 17

A vulnerability scanner made by Rapid7

Question 18

Vulnerability Scans: explain what QualysGuard is doing?

Answer 18

Another commercially available vulnerability scanner

Question 19

Vulnerability Scans: explain what OpenVAS is doing?

Answer 19

An open-source vulnerability scanner

Question 20

Vulnerability Scans: explain what Nikto is doing?

Answer 20

Open-source web server scanner that performs comprehensive tests against web servers such as utdated server software, misconfigurations, and known vulnerabilities in web servers and web applications

Question 21

Vulnerability Scans: what topics should you consider while scanning and explain why (6)?

Answer 21

o Time: Not all scans will take the same amount of time
o Protocols: Each protocol scanned will take time and resources
o Network Topology
o Bandwidth Limitations: The location of the scan depends on your engagement goals and the type of asset you are scanning
o Query Throttling: Reduces the number of queries launched by the scanner at a given time
o Fragile Systems: Determine any fragile or non-traditional systems that could be affected by vulnerability scanning activities