Throughout the course of pen testing, there are automated tools that we utilize
, as we mentioned earlier in the skill, and throughout the course, the ones that
we cover here are going to have their own individual skills.
Now, the reason that we want to automate as much as possible is because we may
not always be in a single, like a group of pen testers, it may just be us by
ourselves.
And automation allows us to be able to multitask as efficiently as possible,
while also keeping our attention focused on the most important matters at hand,
and that is being able to exploit systems and crack into them.
Testing security systems, right?
Now, we're just going to be reviewing what these are and what they do, because
the knowledge of these automated tools, and these aren't all of them by any
means.
These are just the big ones that we want to cover here.
There are many more out there.
But the knowledge that we gain from these tools and how they are utilized
allows us to be able to implement them in proper situations.
Now, the first one that we're going to be covering is Nessus, I'll highlight
that here in just a second, and it's a vulnerability assessment scanner that
allows us based on definitions that we input inside of our scanner.
Allows us to be able to scan a whole network of systems defined by an
individual IP address or a scope of IPs that we input into the scanner itself.
Now, this is based on definitions that are generated from either Nessus
themselves or however you put them together, or whatever vendor you get them
from.
For instance, the DOD makes their own definitions for Nessus scanners, and you
may find that there are third party solutions out there to allow you to do the
exact same thing.
But what this doesn't do is it doesn't go through and identify the exact
exploit we could use or hit those offline systems.
Nessus allows us to be able to do a scanning of the system as a vulnerability
assessment for things that are currently connected.
And the ability to get further insight into those systems depends on if we have
the credentials to access that system as an administrator or some sort of
elevated user.
So like Nessus with any other vulnerability scanner out there, if you don't
have system access, you're only going to be able to scan the targeted system or
systems as a generic outside user.
So basically whatever is forward facing.
So if the firewall on that individual system or endpoint protection is
completely shut down and not allowing any outside traffic to come in, you're
only going to get results based on what's breaking through.
So if ICMP is allowed, you may get a result back saying that ICMP is allowed,
but there may not be any known vulnerabilities to it.
The more permissions you have on an individual system and the more systems that
you know that exist allow you to be able to go through and scan more systems at
a more detailed level.
And in order to do that, we have another automated tool that gets its own skill
as well called in map.
Now in map is a terminal command line program that allows us to be able to
sleep at its higher range of IP addresses to let us know basically what's alive
.
And you could further tell us based on the ports that are open TCP and UDP, if
that system has different things running on it. For instance, let's say that
you have a server that comes back with TCP 53 as an open port.
Well, in map is going to try to identify that based on how the packet responds
to a three way handshake.
And generally it's going to come back as a DNS server of some type.
Now those results will be issued in in map.
And again, if the firewall or IDS and IPS systems on that organization's
network prevent networks sniffing like that from outside or restricted IP
addresses, you're only going to get what's available to you.
And you may have to further increase your knowledge of being able to penetrate
the system even more.
We'll cover that when we get into lateral exploits and pivoting.
Now only bring these up because these are just a couple of the things that we
cover throughout the rest of this course. There are going to be many, many more
, but it's just something to keep in mind as we're going through and doing our
assessment scanning.
And where this breaks into online offline differentials is that while we may
have a scanner that's in offline mode, we have to use online resources to be
able to fill those definitions or create some more.
The databases that we explored earlier in the skill fill in some of those
definitions that we could create on our own.
And they also provide insight into how predefined definitions are made for us.
So Nessus has their own definition tables that you can update rules for and
things like that.
And where do you think all that stuff comes from?
It comes from CVEs and known vulnerabilities exploits, even things like the
zero day database that we covered earlier.