CMU6XX

Ethical Hacking

Session 4: Vulnerability Analysis

James Williams

jwilliams@staff.newman.ac.uk

Learning Objectives

  • Navigate Vulnerability Databases (CVE, NVD, Exploit-DB).
  • Configure automated vulnerability scanners (Nessus, OpenVAS) safely.
  • Differentiate between false positives and verifiable exploits.
  • Cross-reference scanner output with manual exploitation frameworks (Metasploit).
  • Analyze the impact of unauthenticated network vulnerabilities.

Seminar Structure (3 Hours)

Part 1: Automated Scanning (1.5 hrs)
  • The CVE Ecosystem
  • Nessus and OpenVAS
  • Task 1: Scanner Profile Configuration
Part 2: Manual Verification (1.5 hrs)
  • False Positives & False Negatives
  • Exploit-DB & Metasploit Integration
  • Task 2: Manual Exploit Verification

Part 1: Automated Scanning

Duration: 1.5 Hours

The CVE Ecosystem

Common Vulnerabilities and Exposures (CVE) is a dictionary of publicly known information security vulnerabilities.

  • Format: CVE-YYYY-NNNNN (e.g., CVE-2014-0160 for Heartbleed).
  • NVD: The National Vulnerability Database synchronizes with CVE to provide CVSS scoring and mitigation references.
  • Vulnerability scanners use these databases to match the software versions they enumerated against known flaws.
Practical Resource: NIST National Vulnerability Database

Automated Scanners (Nessus/OpenVAS)

Enterprise tools designed to scan entire subnets and generate compliance reports.

  • Unauthenticated Scans: Scans from the outside in. Identifies missing patches, default passwords on web portals, and exposed services.
  • Authenticated (Credentialed) Scans: The scanner is given SSH/RDP keys to log into the machine and check the local registry and package manager. Far more accurate.

The Danger of Automated Scanning

Scanners are "dumb" and aggressive. They throw thousands of packets a second.

  • Denial of Service (DoS): Legacy systems (e.g., SCADA/ICS in manufacturing, old hospital equipment) often crash when hit with an aggressive Nmap or Nessus scan.
  • Account Lockouts: If a scanner attempts to test default credentials against an Active Directory service, it may accidentally lock out the entire company.
A pentester must meticulously configure scan policies based on the specific target environment.

Introduction to Task 1

Running a default "Basic Network Scan" in Nessus against a production environment is a recipe for disaster.

We will architect a safe scanning policy for a fragile network environment.

Task 1: Scanner Profile Configuration

Timing: 45 minutes

You have been contracted to scan a manufacturing plant running legacy SCADA controllers on subnet 10.0.50.0/24.

  1. Identify three specific configuration changes you must make to a default Nessus/OpenVAS policy to prevent knocking the controllers offline (e.g., modifying concurrent connections, disabling "Safe Checks").
  2. Explain why Authenticated Scans are preferred in this environment, despite being harder to configure.
  3. Draft an emergency rollback plan to present to the plant manager before scanning begins.

15 Minute Break

Please return promptly for Part 2.

Part 2: Manual Verification

Duration: 1.5 Hours

False Positives & Negatives

A scanner's report is the beginning of a pentest, not the end.

  • False Positive: The scanner flags a vulnerability that doesn't exist (e.g., flagging Apache 2.4 as vulnerable because it reads the banner, ignoring that the OS vendor backported the security patch).
  • False Negative: The scanner misses a critical vulnerability (e.g., complex business logic flaws in a custom web application).

Exploit-DB & SearchSploit

Once you identify a service (e.g., vsftpd 2.3.4), you need to find an exploit.

  • Exploit-DB: An archive of public exploits and vulnerable software maintained by Offensive Security.
  • SearchSploit: The command-line tool in Kali Linux that allows you to search Exploit-DB offline.
  • Warning: Never run an exploit script downloaded from the internet without reading the source code first. Many are backdoored.
Practical Resource: Exploit Database

Metasploit Integration

The Metasploit Framework (MSF) bridges the gap between vulnerability discovery and exploitation.

  • You can import Nessus .nessus or Nmap .xml files directly into the Metasploit database using db_import.
  • MSF can automatically map discovered CVEs to its internal exploit modules, significantly accelerating the exploitation phase.

Introduction to Task 2

To provide value to a client, a pentester must prove that a vulnerability is exploitable in their specific environment, turning a theoretical risk into a proven threat.

We will simulate the process of taking a Nessus finding and verifying it manually.

Task 2: Manual Exploit Verification

Timing: 50 minutes

A Nessus scan reports that a target server is vulnerable to CVE-2017-5638 (Apache Struts 2). The scanner assigned it a CVSS of 10.0.

  1. Use the internet to research CVE-2017-5638. What is the mechanism of the vulnerability? (Hint: Content-Type header).
  2. Write the exact Metasploit console (msfconsole) commands to search for this exploit, select it, and show its required options.
  3. Explain how demonstrating successful Remote Code Execution (RCE) changes the narrative in the final client report compared to just handing them the Nessus output.

Summary & Next Steps

  • Automated scanners are force multipliers, but they cannot replace the critical thinking of a human analyst.
  • Always verify scanner findings. A report full of false positives destroys your credibility.
Next Week: System Hacking & Exploitation (Gaining & Maintaining Access)