Vulnerability Scanning With Nmap

Key Takeaways

[Music] hello everyone welcome to this video in this video we're going to be taking a look at how to perform vulnerability scanning with nmap more specifically how to do this with the vulner's nmap script now this is a script that was previously not uh it was did not come pre-packaged with the default nmap scripts but now it is and the reason i'm currently on the github repository is to just give you an introduction to this particular script right so again the script is called the vern the vulners script and again it is used to enumerate uh you know vulnerability or information about certain vulnerabilities based on the banner or the service versions that you're you actually get during a particular scan so again this is used as a very simple vulnerability scanner in that it gives you the various cves all the vulnerabilities and the actual rating here in terms of the severity so again sorted from 0 to 10 0 being the lowest 10 being the highest so on and so forth which can be very helpful before you actually start using any commercial vulnerability scanning tools this can give you a very good idea of what you're dealing with now as i said this script already comes pre-packaged uh with in any default nmap installation and using it is a fairly simple and all you need to do is you can actually view the usage here ensure that you're performing service version detection and then you want to pass the script vulners and you can then specify the script arguments and specify the minimum cvss so again you can specify uh what minimum rating you want to be displayed so that you have a more concise uh you have more concise results uh that again might be that will display you know vulnerabilities that are higher up on the list in terms of severity as opposed to displaying all of the vulnerabilities so again uh as i said you can find it um we say al let me just display the default nmap scripts directory and again i'll just pipe and grip and i'll say we're looking it is called if we just again take a look at the name here you can see the script name is called vulners so again we just type in vulners um and that will display it there we are it's a wonders.nse so again using it as i said is very very simple uh we'll be targeting the metasploitable 2 vm so again what i'll do is i will just say nmap and we'll make sure to run sudo with this in the event it does prompt us to do that we say nmap sv and um we can be performing a scan probably on let's say port 21 all the way to port 8080 so that's that's a pretty uh you know comprehensive type of scan you know regarding the services we're looking for so script the script is going to be vulners um and we specify the target 192.168.1.217 and i hit enter right and we're going to give this a few seconds or up to a minute based on depending on the amount of ports you're going to be scanning and of course you can increase the speed of the scan which we actually can do but what i'm going to do is i'm just going to let this complete scanning and shortly after we can then take a look at the results if we go back to the github repository you can also see we have the http vulners rejects script which allows you to scan http responses and identify cpes for the mentioned software which can be very very uh important so again that's a script that you want to check out i'll probably be making a video covering this uh again separately because this deals with http primarily all right so you can see we have a ton of results here and we'll start right from the top here so you can see that for every particular port we get the vulnera script running and it gives us the cpe right so it tells us we're dealing with openness age 4.7 p1 and then gives us the various cves uh the rating uh you know the severity here and uh it gives us the a link to the onenote to through the vulners.com cve website where it has a listing of this particular cve and you know it gives you information regarding the disclosure date uh stuff like that so what i'm gonna do is i'll just copy this link and we will open this up within firefox and i'll say paste and go right and um we'll let this load up and this is the official vulneras website so we'll just say um i'm not a robot here mountains or hills uh let's see what can we click that looks like a mountain or hill here there we are submit and this will just display information about this particular cv so again it tells you that the open sh 5.6 and earlier when g jpeg is enabled does not properly validate public parameters etc etc gives us the cvss score here and you know the the uh the actual disclosure date uh the affected vendors um because uh it actually that's very important based on the platform you're using it you're actually exploiting this on um and then of course you have the references uh which you can actually check out right over here so again very very helpful uh we take a look at some of the other results uh you can see we'll avoid dns right now for apache httpd 2.2.8 you can see we have a cve with a rating of severity rating severity rating of 10 and again you can check out more about this but you can see how helpful this is in that it gives you an idea already of what services you you should be targeting uh as you move forward so it sort of gives you the low hanging fruit uh and of course you need to validate this uh with a vulnerability scanner because uh you know relying on a simple script might not be enough or might not be accurate to you know to give you an accurate or to give you a a total uh image or picture of the target and all the vulnerabilities that might be affecting it um so that being said that's pretty much all that i wanted to cover i'll be putting a link to this particular repository in the this in the resources section of this particular video and you'll be able to check it out for yourself as i said it already comes pre-set up with nmap or any default nmap installation so you should be able to use it and yeah that's pretty much all i wanted to cover in this video and i'll be seeing you in the next video [Music] you