OpenVAS,Nessus,GFI LanGuard,Nikto -Vulnerability Assessment Tools

 

OpenVAS,Nessus,LGuard,Nikto -Vulnerability Assessment Tools
I used various tools to analyze vulnerabilities in this lab. These tools provide the detection of security vulnerabilities and malware in physical, virtual, and cloud environments. By following the paths taken by an attacker, as we learned in the introduction to ethical hacking, we will discover our system's weaknesses and find solutions to it. As an ethical hacker, we conduct penetration tests for companies' systems and network security in business life. Even if I do not have such experience professionally, I am familiar with terminologies. I guess I can feel like a true ethical hacker in the lab because of the scenario. Penetration testing service ensures that organizations are prepared and resilient against cyber attacks. Thus, by thinking like a hacker, applying infiltration and capture scenarios to the system, and trying all the methods that attackers can try, they ensure that the system's vulnerabilities are repaired and the security tightened when a real attack is encountered.   OpenVAS: For this purpose, I used openVas, Nessus, LGuard, and nikto tools. Openvas came with old versions of Linux. However, it is not available in new versions. Many additional packages are required for its installation. A lot of users like me have encountered some installation errors.  I ran the program using parrot Linux for this.  I entered the target IP address for Openvas scan. After a short while, I got the scan results.    Many security vulnerabilities were found in the system.    was enough to click on them to examine them in detail. I wanted to do a more detailed search of the vulnerabilities found. I chose a critical vulnerability then searched using the cve.mitre and nvd.nist.gov websites.  Then I searched using the "searchsploit" command using the terminal to gather some more information.    In this way, I have reached detailed information about vulnerabilities and exploits   Nessus:  Our next tool, Nessus, is one of the best for vulnerability scanning and analysis. We can say that it is the most used tool in vulnerability assessments. One year ago, at an ethical hacker workshop I attended, I met company managers who wanted to hire someone who only knew how to use Nessus. Then I decided to use Nessus. Anyway, I used the Nessus program on my windows computer. I configured the scan settings as recommended in the lab. I then entered the target IP range.   The scan took a little longer. In the meantime, I constantly received notifications because the firewall and anti-virus program was active on the computer I used to scan.  After a while, I got the scan results.  As you can see at the top, the virtual machine I left open for penetration testing is in great condition! I examined the vulnerabilities in detail.   These results will help me keep my system up-to-date and secure at all times. Of course, it will also allow me to find exploits to hijack the virtual machine later.   GFI LanGuard: It scans your operating systems, virtual environments, and installed applications through vulnerability control databases. It allows you to analyze the state of your network security, identify risks, and determine how to take action before being compromised. The scanning process is carried out similarly to the others. Useful program. I will love it more if it's free.   Nikto:  We used Nikto for banner grabbing before. Let's define the program by using Ec-Council documents because this is the best and educational resource.   “Nikto is an Open Source (GPL) web server scanner that performs comprehensive tests against web servers for multiple items, including over 6700 potentially dangerous files/programs, checks for outdated versions of over 1250 servers, and version specific problems on over 270 servers. It also checks for server configuration items such as the presence of multiple index files and HTTP server options; it will also attempt to identify installed web servers and software. “ <this part is an excerpt from Ec-Council University.)  Nikto is more than we thought.   As you can see, I used nikto to find out the vulnerability of the target web server and to get detailed information about it. I did the scan using 2 different parameters. And i saved the results as a txt file.     Thanks and regards Tarkan AYDINONAT