Manual Search vs Automated search for vulnerabilities#

  • the vulnerability scanner Nessus has both a free (community) edition and commercial. The commercial version costing thousands of pounds for a year’s license will likely be used in organisations providing penetration testing services or audits.
  • Frameworks such as Metasploit often have vulnerability scanners for some modules; Manual scanning for vulnerabilities is often the weapon of choice by a penetration tester when testing individual applications or programs.
  • Lets have a look at the type of Vulns
    Security Misconfigurations 
#Security misconfigurations involve vulnerabilities that are due to developer oversight. For example, exposing server information in messages between the application and an attacker.

Broken Access Control	
#This vulnerability occurs when an attacker is able to access parts of an application that they are not supposed to be able to otherwise.

Insecure Deserialization	
#This is the insecure processing of data that is sent across an application. An attacker may be able to pass malicious code to the application, where it will then be executed.

Injection	
#An Injection vulnerability exists when an attacker is able to input malicious data into an application. This is due to the failure of not ensuring (known as sanitising) input is not harmful.

Finding Manual Exploits#

  • Rapid7 Much like other services such as Exploit DB and NVD, Rapid7 is a vulnerability research database. The only difference being that this database also acts as an exploit database. Additionally, the database contains instructions for exploiting applications using the popular Metasploit tool.
  • GitHub is a popular web service designed for software developers. Security researchers store & share PoC’s (Proof of Concept) on GitHub, turning it into an exploit database in this context.
  • Searchsploit - Searchsploit is a tool that is available on popular pentesting distributions such as Kali Linux. This tool is an offline copy of Exploit-DB, containing copies of exploits on your system. We can use this as searchsploit wordpress to search for vulnerabilities of wordpress.