3

I am with all fairness not the most experienced penetration tester, I am doing an industry placement where I can improve my skills. I am using Armitage in Kali Linux to check for vulnerabilities in the company's network (I have permission from manager).

The manager told me to write a list of exploits I wish to try against the live site, and then he can check before letting me use them.

After doing a complete nmap scan, and clicking find exploits Armitage has given me hundreds of vulnerabilities which could be exploited. If I tried I believe most would NOT work (highly unlikely the site is so vulnerable).

To find a list of exploits which would work there is an option some exploits support called "Check Exploit", this way I can give my manager a list of exploits which the site is vulnerable to.

My question: what actually happens when you check an exploit? I for example don't want to launch an exploit and take down a live site (it would cost me my job!).

Thanks!

3

The suggestions of suitable exploits are generated by banner grabbing in most cases. For example, if a webserver returns something like nginx/1.9.4 in the header Metasploit will assume that this software is running in the specified version. But this is not always the case for various reasons. (Backporting of security patches like Debian does for example)

The Check Exploits option will add deeper checks and in various cases, it will try to exploit the vulnerability since in various cases there is no other way to determine whether a target is vulnerable or not. But it hardly depends on the module which is used and not all modules are supporting the check method.

For most of software testing it's best practice to avoid doing it on production systems. This is especially the case for pentests since in most cases an exploit is triggering undefined behavior of the software and its impossible to predict the outcome. I highly recommend to split the scanning (even this can trigger unwanted effects) and testing into smaller portions and doing it against a test system or at least outside of the main business hours.

1
  • Thanks for your feedback. Question I have now is that Armitage is showing me hundreds of exploits because it assumes the site might be vulnerable to them (based on things like header information). Would this also happen if Armitage is unsure of which exploits might work, so it lists everything in the attack menu and you have to decide? Sorry if I misunderstood this part in your answer.
    – k1308517
    Mar 17 '16 at 9:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.