# Vulnerability

## Vulnerability Scanner

### Nessus

{% tabs %}
{% tab title="Info" %}
Vulnerability scanner very powerful.

Runs on port **`8834`** tcp.

Nessus has two parts *(both can be on the same machine)*:

* **Client** to configure the scan.
* **Server** to perform the scan and send the results to the client.
  {% endtab %}

{% tab title="Setup" %}
For **Free License** register [HERE](https://www.tenable.com/products/nessus/activation-code).\
For **Download** [HERE](https://www.tenable.com/downloads/nessus?loginAttempted=true).

[Start & Stop](https://docs.tenable.com/nessus/Content/StartOrStopNessus.htm):

{% code overflow="wrap" %}

```bash
systemctl start nessusd
systemctl stop nessusd
```

{% endcode %}

{% code overflow="wrap" %}

```powershell
net start "Tenable Nessus"
net stop "Tenable Nessus"
```

{% endcode %}

Go to: **`https://<MY_IP>:8834/`**

Create a local account.
{% endtab %}

{% tab title="Other" %}

<table><thead><tr><th width="247">Tool</th><th>Details</th></tr></thead><tbody><tr><td><a href="https://raw.githubusercontent.com/eelsivart/nessus-report-downloader/master/nessus6-report-downloader.rb">nussus_downloader.rb</a></td><td>Interactive script for download report<br><code>./nessus_downloader.rb</code> </td></tr></tbody></table>
{% endtab %}
{% endtabs %}

### OpenVAS

{% tabs %}
{% tab title="Info" %}
Vulnerability scanner open-source and free.

Runs on port **`8080`** tcp.

Like nessus, OpenVAS also has two parts *(both can be on the same machine)*:

* **Client** to configure the scan.
* **Server** to perform the scan and send the results to the client.
  {% endtab %}

{% tab title="Setup" %}
{% code overflow="wrap" %}

```bash
sudo apt-get install gvm && openvas
```

{% endcode %}

Initialization process (can take up to 30 minutes):

{% code overflow="wrap" %}

```bash
gvm-setup
# note credentials
```

{% endcode %}

Start & Stop:

{% code overflow="wrap" %}

```bash
gvm-start
gvm-stop
```

{% endcode %}

Go to: **`https://<MY_IP>:8080/`**
{% endtab %}
{% endtabs %}

### Tools & Other

{% tabs %}
{% tab title="Tools" %}

<table><thead><tr><th width="155">Tool</th><th>Details</th></tr></thead><tbody><tr><td><a href="https://nmap.org/book/nse-usage.html#nse-categories">nmap</a></td><td><em><mark style="color:blue;"><code>/usr/share/nmap/scripts/</code></mark></em> <br><code>nmap --script-updatedb</code><br><code>nmap --script--help &#x3C;SCRIPT></code><br><code>nmap --script "&#x3C;SCRIPT or TYPE[safe,vuln,external]>" &#x3C;IP></code></td></tr><tr><td><a href="https://github.com/sullo/nikto">nikto</a></td><td>Server Web Scanner.<br>Edit <code>/var/lib/nikto/nikto.conf.default</code><br><code>nikto -h &#x3C;URL> -o &#x3C;OUTPUT.html> -Format html</code></td></tr><tr><td><a href="https://github.com/wpscanteam/wpscan">wpscan</a></td><td><a href="/pages/XCd71Q9OK3q6XYbX41j1">WordPress</a> Security Scanner.<br><code>wpscan --url &#x3C;URL> --random-user-agent -o &#x3C;OUTPUT> -e p --plugins-detection aggressive --api-token &#x3C;API_KEY></code></td></tr></tbody></table>
{% endtab %}

{% tab title="Still to be seen" %}

<table><thead><tr><th width="173">Tool</th><th>Details</th></tr></thead><tbody><tr><td><a href="https://github.com/projectdiscovery/nuclei">nuclei</a></td><td>Fast scanning on a large number of hosts</td></tr><tr><td><a href="https://www.qualys.com/apps/vulnerability-management-detection-response/">Qualys</a></td><td>Vulnerability Management, Detection &#x26; Response</td></tr><tr><td><a href="https://www.rapid7.com/products/nexpose/">Nexpose</a></td><td>Vulnerability scanner from Rapid7</td></tr></tbody></table>
{% endtab %}
{% endtabs %}

## Research Exploit

Very important to analyze the exploits found very carefully, they could be harmful!

{% tabs %}
{% tab title="Tools" %}

<table><thead><tr><th width="164">Tools</th><th>Detail</th></tr></thead><tbody><tr><td><a href="https://www.exploit-db.com/searchsploit">searchsploit</a></td><td>Exploit-db database locally and offline.<br><code>sudo apt install exploitdb</code><br><code>searchsploit -u</code>   <em>(update)</em><br><code>searchsploit &#x3C;STRING></code>   <em>(get ID)</em><br><code>searchsploit -w &#x3C;STRING></code>   <em>(get LINK)</em><br><code>searchsploit -x &#x3C;ID></code>   <em>(see l'exploit)</em><br><code>searchsploit -m &#x3C;ID></code>   <em>(Copy exploit + info)</em></td></tr></tbody></table>
{% endtab %}

{% tab title="Website" %}

* [Exploit-DB](https://www.exploit-db.com/)
* [Sploitus](https://sploitus.com/)
* [Packet Storm](https://packetstormsecurity.com/)
* [Rapid7](https://www.rapid7.com/db/) *(metasploit)*
* [sploitify](https://sploitify.haxx.it/)
  {% endtab %}
  {% endtabs %}


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://ivalexev.gitbook.io/rednote/pentesting-process/vulnerability.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.