The document discusses systems vulnerability scanning and network vulnerability scanning. It provides an overview of vulnerability scanning concepts like open port identification, banner checking, traffic probing, and vulnerability probing. It also discusses vulnerability assessment tools like OpenVAS and Metasploit. The document defines computer security vulnerabilities and examines the causes and harms of vulnerabilities. It explores concepts like vulnerability management, vulnerability scanning, and why attackers scan for open ports.

1. Cyber Security
UNIT - 1
Systems Vulnerability
Scanning Overview

2. Outline....
• Systems Vulnerability Scanning Overview of vulnerability scanning
• Open Port I Service Identification
• Banner I Version Check
• Traffic Probe
• Vulnerability Probe
• Vulnerability Examples
• OpenVAS
• Metasplolt

3. Outline....
• Networks Vulnerability Scanning
• Datapipe
• Fplpe
• WlnRelay
• Network Reconnaissance
• Nmap
• THC-Amapand System tools
• Network Sniffers and Injection tools
• T
cpdump and Windump
• Wlreshark
• En ercap
• Hp
l
ng Kismet

4. SystemsVulnerability
• In cyber security,a vulnerability is a weakness which can be exploited by
a cyber attack to gain unauthor ized access to or perform
unauthorized actions on a computer system.
• Vulnerabilities can allow attackers to run code, access a system's
memory,install malware,and steal,destroy or modify sensitive data.
• To exploit a vulnera bility an attacker must be able to connect to the
computer system. Vulnerabilities can be exploited by a variety of
methods including SQL injection, buffer overflows, cross-site scripting
(XSS) and open source exploit kits that look for known vulnerabilities and
security weaknesses in web applications.

5. Vulnera bility Definition
• National Institute of Standards and Technology (NIST}: Weakness in
an information system, system security procedures,inter nal controls, or
implementation that could be exploited or triggered by a threat source.
• ISO 27005: A weakness of an asset or group of assets that can be
exploited by one or more cyber threats where an asset is anything that
has va lue to the organiza tion, its business operations and their
continuity, including information resources that support the
organization's mission.

6. Vulnerability Definition
• IETF RFC 4949: A flaw or weakness in a system's design,
implementat ion, or operation and management that could be
exploited to violate the system's security policy.
•ENISA: The existence of a weakness, design, or implementation
error that can lead to an unexpected,undesirable event compromising
the security of the computer system, network, application, or
protocol involved.
•The Open Group: The probability that threat capability exceeds the
ability to resist the threat.
•Factor Analysis of Information Risk: The probability that an asset will
be unable to resist the actions of a threat agent.

7. Systems Vulnerability
••
-
·
-
-
·
·
-
I
.
bplolQf N ) ' . W . 1.A
nKiMm1Ydwnl)o
. . . . . . . _ " " _ . , " ' " . . . , 1
1. C WVflf
Cl
¢ U l 5 " "
S
O
<
l
l
l
'
·"- -...-

8. Common Computer Security Vulnerabilities
Weo1
t passwords
Cross-siteKrlpl na .and forgery Vuln t ri lbll• V
OScommand injKtlon
Downlo of c:odtf Wtthoul lnltRrir checks

9. Causes and Harms of Computer Security Vulnerabilities
• Computer system vulnerab ilities exist because programmers fail to
fully understand the inner programs. While designing and
programming,programmers don't really take into account all aspects of
computer systems and this, in turn, causes computer system
vulnerability.
• Some programmers program in an unsafe and incorrect way, which
worsen computer system vulnerability.
• The harm of computer system vulnerability can be presented in
several aspects,for example,the disclosure of confidential data, and
widespread of Internet virus and hacker intrusion, which can ca use
great harm to enterprises and individua l users by bringing about
major economic loss.

10. Causes and Harms of Computer Security Vulnerabilities
• Computer security vulnerability can harm five kinds of system
securities that include: Reliability, confidentiality, entirety, usability, and
undeniableness.
• Reliability: This refers to reducing incorrect false alarm in the
operation of a computer system and enhancing the efficiency of a
computer system.
• Confidentiality: This refers to protecting users' information
from disclosure and getting by unauthorized third party.
• Entirety: This system security requires that information or programs
should not be forged, tampered, deleted or inserted deliberately in the
process of stor ing,operation and communication. In other words,
information or programs cannot be lost or destroyed.

11. Causes and Harms of Computer Security Vulnerabilities
• Usabil ty: This ensures that users can enjoy the services offered by
computers and information networks.
• Undeniableness: This security refers to guaranteeing information
actors to be responsible for their behavior.

12. Should knownvulnerabilitiesbe publiclydisclosed?
• Immediate full disclosure: Some cybersecurity experts argue for
immediate disclosure including specific information about how to
exploit the vulnerability. Supporters of immediate disclosure believe it
leads to secure software and faster patching
improving software
security, application security, computer security, operating system
security and information security.
• Limited to no disclosure: While others are against vulnerability
disclosure because they believe the vulnerability will be exploited.
Supporters of limited disclosure believe limiting information to select
groups reduces the risk of exploitation.

13. What isthe difference betweenVulnerability and Risk?
• Cyber security risks are common ly classified as
vulnerabilities. However, vulnerability and risk are not the same
thing, which can lead to confusion.
• If the impact and probability of a vulnerability being exploit is low,
then there is low risk.
• Inversely, if the impact and probability of a vulnerability being exp loit is
high, then there is a high risk.

14. What isVulnerability Management?
• Vulnerability management is a cyclical practice of identifying,
classifying, remediating and mitigating security vulnerabilities. The
essential elements of vulnerability management include vulnerability
detection,vulnerability assessment and remediation.
• Methods of vulnerability detection include:
• Vulnerabilty scanning
• Penetration testing
• Google hacking

15. What isVulnerability Management?
• Once a vulnerability is found, it goes through the vulnerability
assessment process:
• Identify vulnerabilities: Analyzing network scans, pen test results,
firewa ll logs, and vulnerability scan results to find anomalies that
suggest a cyber attack could take advantage of a vulnerability.
• Verify vulnerabilities: Decide whether the identified vulnerability
could be exploited and classify the severity of the exploit to
understand the level of risk
• Mitigate vulnerabilities: Decide on countermeasures and how to
measure their effectiveness in the event that a patch is not available.
• Remediate vulnerabilities: Update affected software
or hardware where possible.

16. What isVulnerability Scanning?
• A vulnerab ility scanner is software designed to assess computers,
networks or applications for known vulnerabilities.
• Authenticated Scans: Allows the vulnerability scanner to directly
access networked assets using remote administrative protocols
like secure shell (SSH) or remote desktop protocol (RDP) and
authenticate using provided system credentials.
• This gives access to low-level data such as specific services
and configuration details, providing detailed and accurate
information about operating systems, installed software,configuration
issues and missing security patches.

17. What isVulnerability Scanning?
• Unauthenticated Scans: Result is false positives and unreliable
information about operating systems and installed software.
• This method is generally used by cyber attackers and security ana lysts to
try and determine the security posture of externally facing assets and to
find possible data leaks.

18. Open Port
• In cybersecur ity, the term open port refers to a TCP or UDP port
number that is configured to accept packets.
• In contrast, a port which rejects connections or ignores all packets, is a
closed port.
• Ports are an integral part of the Internet's communication model. All
communication over the Internet is exchanged via ports.
• Every IP address contains two kinds of ports, UDP and TCP ports,and
there are up to 65,535 of each for any given IP address.
• Services that rely on the Internet (like web browsers, web pages,and file
transfer services) rely on specific ports to receive and transmit
information.

19. Open Port
• Once a service is running on a certain port, you can't run other
services on it. For example, starting Apache after you've already
started Nginx on port 80 will lead to a failed operation because the
port is already in use.
• Open ports become dangerous when legitimate services are exploited
through security vulnerabilities or malicious services are introduced to
a system via malware or social engineering,cybercriminals can use
these services in conjunction with open ports to ga in unauthorized
access to sensitive data.
• Services that rely on the Internet (like web browsers, web pages,and
file transfer services) rely on specific ports to receive and
transmit information.

20. Why do attackersscanfor open Ports?
• Attackers use open ports to find potential exploits.To run an exploit,
the attacker needs to find a vulnerability.
• To find a vulnerability, the attacker needs to fingerprint all services
that run on a machine, including what protocols it uses, which
programs implement them, and ideally the versions of those
programs.
• To do this, attackers commonly rely on finding a publicly accessible
port via port scanning.