Introduction to computer
attacks
Vulnerability scanning
University of Algiers 1 Benyoucef Benkhedda
Recall: vulnerability
üIt refers to errors in the system itself (it’s construction, setting and conception) which
expose the system to possible threats.
üIt can be:
• Bugs in softwares
• Miss-configurations
• Autorised services but not used
• Softwares in debug mode
ü For examples check: https://www.cvedetails.com/
2
Recall: vulnerability
Zero-day vulnerability
üSuch vulnerability is called « zero-day » when it exists, exploited or can be
exploited and there is no corrective solution YET (update) on the vulnerable
asset.
üThe major challenge in this case for the CISO is to find a way to “at least” cover the
vulnerability until the official solution comes.
3
Vulnerability scanning
• It is considered as an important step of any hacking process in which the hacker
don’t know (or didn’t look on websites) of vulnerabilities
• It refers to the use of some tools (like NIKTO) to identify issues and existed
vulnerabilities in the target system
• These tools allow pre-defined automated tests that are performed, artificial
intelligence can also be used for this
• For opensource and web accessed applications, bug bounty is another suitable job
in some cases highly recommended
4
Vulnerability scanning
Bug bounty
• Two words: bugs or vulnerabilities and bounty or reward
• Bug bounty is in reality a job of developers specialized on source code security
• It uses almost the same techniques for recon and scanning like google dorking, and
bug bounty search engine, github recon…etc.
• It requires high skills in programming rather in hacking
• For more tools check: https://blog.fikara.io/bugbounty
5
Vulnerability scanning
Process
Define scope
Asset
management
Scoping
strategies
Scan
Report
Exposure
6
Vulnerability scanning
Process
1. Define scope:
• Define the objective behind the process
• If you don’t know what you’ve got, you won’t be able to protect it!
2. Asset management:
• Each organization should maintain an asset register for better management
• Vulnerability scanning can be much more efficient when good management exists
7
Vulnerability scanning
Process
3. Scoping strategies:
• It is the step when we choose what to scan ? Or more exactly what and why to scan?
Exposure based:
Systems are scanned for
vulnerabilities by attackers
on a constant basis.
Even unskilled attackers
can automatically scan the
entire
internet
for
weaknesses using freely
downloadable tools.
Sensitivity based:
It comes that online
systems aren’t sensitive,
vulnerability
scanning
against internal sensitive
data can be performed in
this case
Coverage based:
It refers to the possibility
that an exploitation can
lead directly or indirectly to
use attacked system to
attack other systems.
Scanning
to
look
if
sensitive systems are
covered from each other
8
Vulnerability scanning
Types
• Three main types according to scanned object
1. Network-based scanning :
• Scanning by sending probes looking for open ports and services, and then probing
each service further for more information, configuration weaknesses or known
vulnerabilities.
External network-based scanning : in which the scan is done from outside the local
network. The amount of information can be limited according to security obstacles that
can be found
Internal network-based scanning: it is performed by a machine inside the local
network. It is a highly efficient scanning that can reveal much more information about
9
the structure of the network and its components
Vulnerability scanning
Types
• Three main types according to scanned object
2. Agent-based scanning :
• It is performed by installing lightweight software on each component wanted to be
scanned and then report each scanning process to a local server
• More efficient when organization’s structure is based on cloud services
• The efficiency is touched in other way for machines that can be disconnected from
internal network
10
Vulnerability scanning
Types
• Three main types according to scanned object
3. Context-aware scanning :
• It refers to automated scanning using AI in order to allow identifying context and
security issues that can exploit existed vulnerabilities
11
Vulnerability scanning
Types
• Three main types according to scanned object
4. Web application scanning:
• Specialized type of vulnerability scanner which focus on finding weaknesses in web
applications and websites. by ‘crawling’ through a site or application in a similar way
as a search engine would, sending a range of probes to each page or form it finds to
look for weaknesses.
• SQL injections
• Cross-site scripting flaws
• Access control weaknesses
• Exposure of sensitive information
• Weaknesses in multi-step workflows
• Weaknesses involving storing a payload which gets executed elsewhere
12
• Session-based weaknesses
Vulnerability scanning
Tools
Nikto
Microsoft Baseline
Security Analyzer
13