> For the complete documentation index, see [llms.txt](https://ivalexev.gitbook.io/rednote/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ivalexev.gitbook.io/rednote/pentesting-process/vulnerability.md).

# Vulnerability

Perform vulnerability scanning and exploit research.

## Vulnerability Scanner

### Nessus

{% tabs %}
{% tab title="Info" %}
Vulnerability scanner very powerful.

Runs on port **`8834`** tcp.

Nessus has two parts *(both can be on the same machine)*:

* **Client** to configure the scan.
* **Server** to perform the scan and send the results to the client.
  {% endtab %}

{% tab title="Setup" %}
For **Free License** register [HERE](https://www.tenable.com/products/nessus/activation-code).\
For **Download** [HERE](https://www.tenable.com/downloads/nessus?loginAttempted=true).

[Start & Stop](https://docs.tenable.com/nessus/Content/StartOrStopNessus.htm):

{% code overflow="wrap" %}

```bash
systemctl start nessusd
systemctl stop nessusd
```

{% endcode %}

{% code overflow="wrap" %}

```powershell
net start "Tenable Nessus"
net stop "Tenable Nessus"
```

{% endcode %}

Go to: **`https://<MY_IP>:8834/`**

Create a local account.
{% endtab %}

{% tab title="Other" %}

<table><thead><tr><th width="247">Tool</th><th>Details</th></tr></thead><tbody><tr><td><a href="https://raw.githubusercontent.com/eelsivart/nessus-report-downloader/master/nessus6-report-downloader.rb">nussus_downloader.rb</a></td><td>Interactive script for download report<br><code>./nessus_downloader.rb</code> </td></tr></tbody></table>
{% endtab %}
{% endtabs %}

### OpenVAS

{% tabs %}
{% tab title="Info" %}
Vulnerability scanner open-source and free.

Runs on port **`8080`** tcp.

Like nessus, OpenVAS also has two parts *(both can be on the same machine)*:

* **Client** to configure the scan.
* **Server** to perform the scan and send the results to the client.
  {% endtab %}

{% tab title="Setup" %}
{% code overflow="wrap" %}

```bash
sudo apt-get install gvm && openvas
```

{% endcode %}

Initialization process (can take up to 30 minutes):

{% code overflow="wrap" %}

```bash
gvm-setup
# note credentials
```

{% endcode %}

Start & Stop:

{% code overflow="wrap" %}

```bash
gvm-start
gvm-stop
```

{% endcode %}

Go to: **`https://<MY_IP>:8080/`**
{% endtab %}
{% endtabs %}

### Tools & Other

{% tabs %}
{% tab title="Tools" %}

<table><thead><tr><th width="155">Tool</th><th>Details</th></tr></thead><tbody><tr><td><a href="https://nmap.org/book/nse-usage.html#nse-categories">nmap</a></td><td><em><mark style="color:blue;"><code>/usr/share/nmap/scripts/</code></mark></em> <br><code>nmap --script-updatedb</code><br><code>nmap --script--help &#x3C;SCRIPT></code><br><code>nmap --script "&#x3C;SCRIPT or TYPE[safe,vuln,external]>" &#x3C;IP></code></td></tr><tr><td><a href="https://github.com/sullo/nikto">nikto</a></td><td>Server Web Scanner.<br>Edit <code>/var/lib/nikto/nikto.conf.default</code><br><code>nikto -h &#x3C;URL> -o &#x3C;OUTPUT.html> -Format html</code></td></tr><tr><td><a href="https://github.com/wpscanteam/wpscan">wpscan</a></td><td><a href="/rednote/pentesting-process/other/cms/wordpress.md">WordPress</a> Security Scanner.<br><code>wpscan --url &#x3C;URL> --random-user-agent -o &#x3C;OUTPUT> -e p --plugins-detection aggressive --api-token &#x3C;API_KEY></code></td></tr></tbody></table>
{% endtab %}

{% tab title="Still to be seen" %}

<table><thead><tr><th width="173">Tool</th><th>Details</th></tr></thead><tbody><tr><td><a href="https://github.com/projectdiscovery/nuclei">nuclei</a></td><td>Fast scanning on a large number of hosts</td></tr><tr><td><a href="https://www.qualys.com/apps/vulnerability-management-detection-response/">Qualys</a></td><td>Vulnerability Management, Detection &#x26; Response</td></tr><tr><td><a href="https://www.rapid7.com/products/nexpose/">Nexpose</a></td><td>Vulnerability scanner from Rapid7</td></tr></tbody></table>
{% endtab %}
{% endtabs %}

## Research Exploit

Very important to analyze the exploits found very carefully, they could be harmful!

{% tabs %}
{% tab title="Tools" %}

<table><thead><tr><th width="164">Tools</th><th>Detail</th></tr></thead><tbody><tr><td><a href="https://www.exploit-db.com/searchsploit">searchsploit</a></td><td>Exploit-db database locally and offline.<br><code>sudo apt install exploitdb</code><br><code>searchsploit -u</code>   <em>(update)</em><br><code>searchsploit &#x3C;STRING></code>   <em>(get ID)</em><br><code>searchsploit -w &#x3C;STRING></code>   <em>(get LINK)</em><br><code>searchsploit -x &#x3C;ID></code>   <em>(see l'exploit)</em><br><code>searchsploit -m &#x3C;ID></code>   <em>(Copy exploit + info)</em></td></tr></tbody></table>
{% endtab %}

{% tab title="Website" %}

* [Exploit-DB](https://www.exploit-db.com/)
* [Sploitus](https://sploitus.com/)
* [Packet Storm](https://packetstormsecurity.com/)
* [Rapid7](https://www.rapid7.com/db/) *(metasploit)*
* [sploitify](https://sploitify.haxx.it/)
  {% endtab %}
  {% endtabs %}