Original subtitles

Welcome back and in this video, I want to show you something that you will do every time you perform

a penetration test, I want to show you how to manually search for vulnerabilities.

And this is something that you will do a lot.

You will use this more than any other tool that we covered.

So what vulnerability analysis is, is us simply Googling the vulnerabilities, for example, suppose

we are attacking a target and right here I just performed the version scan for the anticipatable imagine.

But this is our target and we just performed this version scan.

We got these different ports open and different versions.

How do we know if they are vulnerable without using any tool?

Well, what we can do is we can copy the name of the version that is running on an open port.

Then go to Google and just paste that name and add explained.

And here it is, we're already getting some response back Python exploit for this version, which is

the exact version the Tagamet display has the feed, the exact version that we have Back-Door command

execution.

And what you would do is you would just go to these links and try to find the exploit for it.

Down here, we already see that an exploit already exists.

For which platform it is, we can see right here the source code if we want to.

And here it is, the expert is quoted in Python in this case and.

This is how you would do most of your vulnerability analysis.

We also get the module options and what this module options are is something that people covering the

exploitation section.

This is how we can exploit the target using tools.

We're going to cover that shortly for now.

This is the way that you can find out how to exploit the target.

You just go through a bunch of links and see whether someone already came up with the exploit for that

specific version, in this case for the fifty two point three point four version.

And you would do this for any version that you discover.

For example, you can go right here, Apache HDD and copy the version.

Make sure that you copy the number as well, which in our case is two point two point eight.

Then go and paste the name of that version and exploit.

And here we are to get output security vulnerabilities.

If we click on it, we can see all of the vulnerabilities that this version of Apache has right here.

We can see which score they have and the hard score, the stronger the vulnerability.

Right here we can see the vulnerability ID which remember from the last video I told you, this format

is used for vulnerabilities and you will see it a lot and we can see all the vulnerabilities that it

has.

This one, particularly if we are really interested in why?

Well, because it has this core 10, that means that it is a really strong vulnerability, most likely

execution of code or remote access to the target.

And it indeed is it says right here, code execution.

And if you click on it.

You can see what this vulnerability does.

You can see confidentiality impact his complete integrity, impact complete availability, impact complete.

There is a total shutdown of the affected resource.

The attacker can render the resource completely unavailable.

So this also seems like some kind of a DOS attack.

And down here, we can see that this will most likely work only for Windows, as I'm noticing windows

right here, a lot of windows right here, windows right here.

Now, of course, you would rip through this other a bit more detailed, but for now, this doesn't

seem as an exploit that would work on our anticipatable because the is running on Linux.

And this is what you would do most of your time researching for mobility.

This is how you find them.

And then you search for the exploit created by someone else that you can use to exploit the target.

Another thing that you can do is you can use a tool inside of the clinic called search plate and search

it if I type that to help.

Simply takes the input of the version of software and then it searches through Callinan's database,

through all of the experts that Kalanick has and tries to find an expert that will work for that specific

version.

Right here, we have some usage examples, but we don't need to perform these complicated commands.

All we can do is copy, for example, some version.

Let's say we copy this version of software on real I.R.S. and copy this.

And what we can do once we copy that version is type Searsport and then paste the version name and we

get the result.

It will tell us.

Right here, there are already some existing experts for the unveiled RC.

We also get which version are the exploits for.

One of them are Back-Door command execution.

The second one is local configuration stack overflow.

We also get the denial of service exploit and on the right side we get the path to those exploits right

here.

This one is under Linux remote and it is named one six nine two two dot RB.

And this RB simply stands for Ruby.

This is coded in the ruby language.

One of them is for Windows, one of them is for Linux.

Since we're running the display table, we would only be interested in the Linux exploits.

So let's try to navigate here how we can find this exploit.

Well, we can copy the name of the exploit.

And use locate command to find where exactly this exploit is located on our machine, and it is in this

path right here.

So you can copy to this directory CD and then paste the directory name, and if I were to Nannerl one

six nine two two dot RB, this will open and exploit that we would use to attack that unreal RC open

port.

As we can see, it also tells us that this is a backdoor program.

This file is also part of metal plate fabric and metal plate is one of the biggest tools that we are

going to cover in the next section.

We'll cover all of the basics of it and we will also cover how we can run exploits and attack different

machines using this display framework.

OK, cool.

We found an exploit for this specific software using search plate.

So now we know we got exploit for that version of software that we have on display.

So this is usually how you would perform most of your vulnerability analysis to either use tools like

exploit or you manually try to find and exploit on Google to see whether anyone has exploited it before.

And if they have, how did they do that?

You would also use and map scripts sometimes, but I personally rarely use AdMob scripts for vulnerability

analysis.

And the last tool that we are going to cover for the vulnerability analysis is going to be Nessa's,

which we will see in the next section.

That tool is huge and you will use it a lot in your vulnerability analysis.

See you there.