let's look at diagram
low risk Square DNS and SMTP
enumerations like to check accounts
whether valid or not this traffics is
looks load to risk traffic
medium risk where searching for security
devices for abnormal use for example we
consider Port scanning as a medium risk
where we check for open ports in
specific device
in high risk detecting applications
checking for specific versions and
identifying vulnerabilities so
vulnerability scanners can be considered
as high risk activity
all right
we are going to dive deep into the
advanced Network scanning techniques
we will look at some clever ways to
understand a system better including OS
fingerprinting versions scanning and
script scanning and we will also explore
some Ninja techniques to avoid detection
and sneak past security measures
let's start with the voice
fingerprinting think of it like the
digital equivalent of a fingerprint
each operating system responds
differently to various Network probes
and we can use this information to
identify what ways a Target host is
using why is this helpful well it gives
us better understanding of the target
environment and helps us choose the
right exploits
tools like nmap and X group 2. 2 are our
friends here for instance in nmap we use
iPhone more flag for OS fingerprinting
in map hyphen who and Target IP so with
that it will fetches with fingerprinting
information
next up is version scanning here we are
trying to figure out the versions of
services and applications running on a
Target host
this is important because different
versions might have a specific
vulnerabilities that we can exploit
in Mac again comes to our guide here
with iPhone
SV flag which helps us conduct version
scanning in map hyphen SV Target IP
script scanning script scanning is
another technique where we run Customs
or pre-built scripts to perform specific
tasks
this could be gathering more information
about Services finding vulnerabilities
or automating some of our tasks nmap
script engine NSE
allows us to write and execute these
scripts so we use it nmap hyphen script
script name art and Target IP
now let's move on to some of the
advanced features of our Network
scanning tools
in map for instance offer features like
a timing controls and IPS spoofing that
can help us evade detection and get more
accurate information about the target
is another tool
is like a digital Speedster
it is so fast it can scan the entire
internet in less than 6 minutes
and gmap is at another high speed
Network scanner that's great for large
scale scans
lastly let's talk about evading
detection and bypassing security
measures one simple way to do this is by
adjusting the speed of our scan which
can help us stay under the radar of
intrusion detection systems and
firewalls we can use fragmented packets
to sneak past firewalls and bypass
firewalls and packet filters
decoy scanning is another technique
where we send package from a fake IP
addresses to make it harder for Defender
to tracers and changing the source Port
can also help us get past firewalls with
strict filtering rules
remember these Advanced Techniques can
provide more detailed and accurate
information about a Target environment
but they should always be used ethically
and with proper authorization being a
digital detective is exciting but it's
important to respect privacy and
legality at all times
all right we are getting into the world
of advanced vulnerability scanning
techniques
we will learn how to uncover and
understand the weaknesses in a Target
system and how to address them
think of vulnerabilities as a weak
points in a fortress by identifying
these we can either plan our attack
strategy or if we are the good guys we
can strengthen these points Advanced
vulnerability scanning techniques allows
us to do this more effectively
some vulnerability scanners have
advanced features like a custom
vulnerability checks and compliance is
scanning what are these exactly custom
vulnerability checks allows us to
identify organization specific
vulnerabilities or test customer
applications
so if we are looking at a unique setup
or best box software the checks comes in
handy tools like nessus use a scripting
language called nasl for this while open
bass uses something called Network
vulnerability test or nvts
complaints scanning on the other hand is
all about making sure that system others
to specific security standards and
regulations
for instance if we are dealing with a
company that handles credit card data
we might want to check that they are
adhering to the PCI DSS standard or if
it is a healthcare provider
HIPAA HIPAA would be the relevant
standard tools like a qualis guard
necess and inexposed are a great for
this
we also have a specialized tools for
scanning web applications these are
things like ovasp job burp suit and
acunetics they Crawl Through the web
applications and look for security flaws
like input validations issues or
misconfigurations
once we have identified vulnerabilities
we need to validate them and prioritize
how we are going to address them
unfortunately our scanning tools might
give us some false positives so we need
to confirm the vulnerabilities manually
or with additional tools like a
Metasploit once we are sure
vulnerability exists we need to assess
the risk How likely is that an attacker
will exploit it what would be the impact
to be how critical the is the asset
that's at risk these are the factors we
need to consider
finally we prioritize the
vulnerabilities based on their risk
level we address the highest risk
vulnerabilities first we might patch the
software Implement additional security
controls or modify configuration to
reduce the risk
in conclusion mastering Advanced
vulnerability scanning techniques can
greatly enhance our ability to identify
risks and Safeguard our systems but
remember this is a tool that should
always be used responsibly always ensure
you have the necessary permissions
before conducting vulnerability scanning
that wraps up our session for today
happy scanning