Learning Kali Linux, 2nd Edition

Chapter 4. Looking for Vulnerabilities

After you perform reconnaissance activities and gather information about your target, you might normally move on to identifying entry points to remote systems. You are looking for vulnerabilities in the organization, which can be open to exploitation. You can identify vulnerabilities in various ways. Based on your reconnaissance, you may have even identified one or two. These may be based on the different pieces of information you obtained through open sources.

Vulnerability scanning is a common task for penetration testers but also for information security teams everywhere. A lot of commercial tools are available to scan for vulnerabilities but also some open source scanners as well. Some of the tools that Kali provides are designed to look across different types of systems and platforms. Other tools, though, are designed to specifically look for vulnerabilities in devices like routers and switches. It may not be much of a surprise that there are scanners for Cisco devices as well.

Most of the tools we’ll be looking at in this chapter will search for existing vulnerabilities. These are ones that are known, and identifying them can be done based on interactions with the system or its applications. Sometimes, though, you may want to identify new vulnerabilities. Tools are available in Kali that can help generate application crashes, which can become vulnerabilities, though the tool won’t create associated exploits. These tools are commonly ...