Armitage check exploit

Question

I am with all fairness not the most experienced penetration tester, I am doing an industry placement where I can improve my skills. I am using Armitage in Kali Linux to check for vulnerabilities in the company's network (I have permission from manager).

The manager told me to write a list of exploits I wish to try against the live site, and then he can check before letting me use them.

After doing a complete nmap scan, and clicking find exploits Armitage has given me hundreds of vulnerabilities which could be exploited. If I tried I believe most would NOT work (highly unlikely the site is so vulnerable).

To find a list of exploits which would work there is an option some exploits support called "Check Exploit", this way I can give my manager a list of exploits which the site is vulnerable to.

My question: what actually happens when you check an exploit? I for example don't want to launch an exploit and take down a live site (it would cost me my job!).

Thanks!

Answer 1

The suggestions of suitable exploits are generated by banner grabbing in most cases. For example, if a webserver returns something like nginx/1.9.4 in the header Metasploit will assume that this software is running in the specified version. But this is not always the case for various reasons. (Backporting of security patches like Debian does for example)

The Check Exploits option will add deeper checks and in various cases, it will try to exploit the vulnerability since in various cases there is no other way to determine whether a target is vulnerable or not. But it hardly depends on the module which is used and not all modules are supporting the check method.

For most of software testing it's best practice to avoid doing it on production systems. This is especially the case for pentests since in most cases an exploit is triggering undefined behavior of the software and its impossible to predict the outcome. I highly recommend to split the scanning (even this can trigger unwanted effects) and testing into smaller portions and doing it against a test system or at least outside of the main business hours.