How can I discover server vulnerabilities without using a scanning software such as openVas? is there any manual ways or steps to follow to assure server security.

Thanks in advance

  • Penetration test tools just automate all known attack to test your server. You can construct such test by gathering all possible vulnerabilities information related to your server and apps and follow those attack step. In short: good for the learner, but not practical – mootmoot Aug 16 '18 at 8:39
  • Agreed but unfortunately sometimes we can not use automated scanners – user181612 Aug 17 '18 at 8:24

So what does OpenVAS actually do? It fingerprints your server, does discovery scans, mappings etc. and then compares your system with an exploit database, identifying all vulnerabilities that are most likely affecting your system.

All these steps can be done by a human in a manual way. You can, for example

  • perform an nmap scan on your server,
  • grab the server banner and identify the OS/server version,
  • check for services that run on the server,
  • search exploit-db for exploits for the services you just discovered,
  • etc.

Depending on your server setting, this is an immense task and extremely tedious and time consuming - that's why automated scanners were implemented in the first place.

Also depending on your server setting (e.g. you own the server, have full admin access to it and to programs' source code), you can do manual audits, code reviews etc. to verify manually if there are any potential vulnerabilities or policy violations present. It all depends on how much time and pain you are willing to put into it.

| improve this answer | |
  • You are totally right. The problem with automated scanners is that they may harm your server and it is a problem when your system is critical. So performing manual scanning would be better. Is there any reference you can provide that might help? – user181612 Aug 16 '18 at 7:55
  • TBH, apart from pentest engagements I've never done any manual vuln scanning. And even within pentest it is mostly "basic" intelligence stuff like the mentioned nmap scanning etc. – SeeYouInDisneyland Aug 16 '18 at 8:36