Later as we continue throughout the course, we're going to be discovering
reconnaissance and vulnerability tools, assessment tools that allow us to be
able to go through and automate a lot of prerequisites for pen testing.
And that's amazing because that can save us a lot of time and effort and allow
us to be able to put concentration into something a little bit more important
at that time.
Could be that we're running a another vulnerability assessment once we're
further inside the private network.
And we've already ran it on the public facing side.
So let's just say, for instance, that we're automating our private network
vulnerability assessment and scanning and focusing in on some of the exploits
or possible exploits that we have found that could exist on the public facing
side.
Basically, allowing us to be able to do two things are more than two things at
once. And that's amazing.
But it's also really important to understand what it is that those
vulnerability and reconnaissance tools are actually doing and how they interact
with the actual system.
Just because something is automated doesn't necessarily mean that it's going to
work every time all the time.
Sometimes you may have a, let's say, in map, for instance, runs a sweep across
the network to identify systems that are out there, but does it run correctly
and it turns out later on, you're actually missing one or two systems because
whatever the case may be.
So it's always important to understand that these tools that while they are
good for automating
workflows for us don't always catch every single thing or truly explain what it
is that's happening behind the scenes.
Just because you see inside of Nessus or whatever your preferred vulnerability
scanner is a CVE or common vulnerability exploit.
That says you could do X, Y and Z to it to be able to pop it doesn't
necessarily mean that's always the case. It's good to be able to dig into those
known databases that other people have worked so diligently to put together to
give us a true understanding of if the suggested doesn't work, then use eggs.
So we're going to be taking a look at some of these databases and get an
understanding of what they are because as we run our vulnerability scanners and
assessments throughout that reconnaissance phase to include in map.
They're going to be referring back to the CVEs and also some other databases.
You'll even see that some exploits are referred to when some of these pop up as
a vulnerability. Like I said, you'll see them later in the course.
But you were what high five W's of truly understanding if it's worth the limit
to get that squeeze in.
So you may have a vulnerability come up that's just not worth it and something
else that comes up. That's a whole lot easier that you don't have to spend
hours on and trying to figure something out.
So let's take a look at our first one and that's going to be CVE.org as I swap
over to the side camera here.
And this one right here is going to be the one that you go to the most because
a lot of vulnerability scanners at least everyone that I've worked with.
But both in the civilian sector and inside of Department of Defense for the
United States use CVEs as our backbone of understanding and also reporting.
As you go in here, you'll be able to see how the CVEs are numbered, how they're
identified and also how they're scored.
Now, at this point, I would like to point out that let's say you want to
understand how a vulnerability got a higher score than another vulnerability
that you found to be even more complex or easier.
However, that may be that's the CVS S scoring system that CVE uses to be able
to identify and that is covered in depth in here on CBT nuggets in the CYS a
course that we have along with any other things.
Now, we're not going to be getting into the actual scoring of this more so than
just seeing where we can go here for actual understanding of CVEs and how they
're reported.
Now, first of foremost, let's say that you have a NASA scan that pops up and
you have a CVE number, you're going to be able to search very quickly for that
inside the actual search bar.
So enter keywords such as what you're looking for or the actual CVE number
itself and we'll take a look at how these are structured here momentarily.
Now, you could also get a whole lot of other information, but for what we're
looking at here, if you don't have a CVE number that comes up out of report and
you're just trying to figure something out as far as, you know, how do we
exploit Microsoft IIS.
Well, we're going to go to our search bar and do Microsoft IIS and did I not
spell that right? I did not.
And right here, you can see that we have a full listing of known CVEs based on
new to old for Microsoft IIS. Now, that's encompassing a lot of different
things here could be versioning could be, you know, type of install could be a
whole lot of things.
But as you can see here, we have our first one, which is CVE 2025 0994.
And this is a very easy representation of how we break these down CVE. It's a
CVE identified 2025 being the year that it was found in and 0994 is in the
order of which it was found.
So that's as simplistic as you can get, but as you look here, we see that CVE
2025 0994 came up in a IIS search result.
Trimble city works version prior to 15.8.9. And so now we're starting to get
into a little bit more details of what the CVE actually is. So let's say that's
the one that we're going to be working with here.
And we're going to go into there, click on it, and you get the actual port
loading up here. You have a breakdown of the actual vulnerability itself, along
with a bunch of other wonderful information.
So first we have the description of what we just read inside the search results
. Then we get a CWE as far as like what's it related to in topics overall.
Then of course that CVSS score that we were talking about, and this one's rated
at 8.6, which makes it a very high vulnerability.
Over here, you can see that the vector string, the CVSS, this is how the score
is generated. And those letters and semicolons and the numbers and stuff like
that, they all play into a different part of how that vulnerability is
discovered, exploited, utilized, etc, etc. And all this information is listed
down below as you go through here.
And gives you an idea of how to be able to leverage that vulnerability or even
if it's worth it for the overall system.
Now, as we continue through, you can definitely get into more details of the
vulnerability itself.
We definitely covered this more inside of CYSA and also the NESA skill that's
coming up here pretty soon.
I do want to cover just a couple of other ones here real quick, such as the
exploit database.
So you found the CME and there's no listed exploit, you say? Well, that's where
this comes in.
And I have links for this all down below so that way you can start exploring
and get an idea of how these all correlate with each other.
Now, so far, we've been dealing with exploits and vulnerabilities that have a
known solution to them.
But we're going to take a look at the first one here, the Microsoft Virtual
Hard Disk VDHX11-RemoteCodeRCE problem for an exploit.
And what you may notice is, as I zoom in here, that we have a lot of
information that correlates with
CVEs. And I'm going to highlight one, sorry, I'm going to zoom out here real
quick, and I'm going to highlight this right here.
Then zoom in. So this exploit that is known correlates with CVE 2025-49683.
And right above that, you could also see how the scoring was done as well too.
So now, if you look for a CVE in the CVE database, you don't necessarily have
to
scratch your head too much to figure out how to exploit it.
There's a lot of help in the exploit database that we have a link below for.
And this is definitely one of those resources or a couple of those resources
that you want to take time to actually examine.
Yes, it's an online resource, but the information that we get can be used
offline as well too.
In the sense that, let's say we're in a private network when we're doing our
pen testing with no internet access. I know that doesn't happen very often.
Looking at you, Army.
But that's information that you can research on a public network.
Print it out, write it down, however you want to do it, hammer and chisel.
Bring it back over to the actual network that you're working with and have more
resources
as you're making notes and logging this and keeping a record book of all these
different
from vulnerabilities and attempts and methods that you're trying.