Vulnerability Scanning and Enumeration

As part of discovery on a network, an adversary is going to be looking for vulnerabilities, and there are ways that they can look for vulnerabilities on that network.

Scanning for Vulnerabilities

Identifying things like the operating system can definitely give us insight into what vulnerabilities are on these devices or within the network, but there are other steps that we can do to enumerate or discover these vulnerabilities within a network.

There is software that both adversaries and defenders use in order to scan their network to figure out if there are vulnerabilities in there. If there is a company that doesn't scan on a regular basis, or doesn't fix those vulnerabilities when they find them, then there could be open vulnerabilities. This is especially true if they don't have a good patching process. So as an adversary attacks a network and comes into the network, they can do scans and immediately find ways to leverage a system through vulnerability scans.

There are ways to do things like stealth scans or TCP scans. We could do credential or non-credential scans, meaning that if we found some sort of credentials we could use those to do scans of systems, but there's also non-credential ways of getting in and scanning systems as well. These scans automatically get updated as well — that is, the software that you're using for scans goes out there and finds what the more recent vulnerabilities are.

There are mechanisms out there such as the common weakness enumeration and the common vulnerabilities and exposure lists. These two are databases that have lists of vulnerabilities out there. So both us as defenders can help guard our systems by using these to make sure that our systems are secure, but an adversary can use that to break into systems as well, because they can use these same available services in order to understand what the weaknesses are on any given system.

Staying Covert While Scanning

One of the problems with scanning is it's a very active process and it could be discovered. So an adversary is going to want to be a little bit covert about this and be careful about when they're doing scans.

If we were the adversary, we'd want to watch out for what time we are running these scans. Are we doing it when everybody's on the network and it's going to disrupt things and then they're going to discover us on the network? Or are we running it after hours when there's not as many people on there?

We need to watch out for the protocols that we're scanning — certain protocols could be more of a trap than others. Or what is the network topology? There are certain areas of the network that maybe we need to watch out for.

Are there bandwidth limitations within the network? Because once again, if we fill up the bandwidth, that's going to be a sure sign that there could be an attack that's being carried out, and we might not want to tip off once again that we are attacking a network.

There's query throttling as well — maybe not scanning everything all at once, but staging it out and doing scans at different times.

There could be some fragile systems out there that, if we tip over, that could be a tip off that we're attacking the system. Or there are some non-traditional assets. Those are both a great target, because a lot of times those go unpatched and we can attack those non-traditional targets, but also, is it something that's sensitive that could actually expose us as we're scanning the network for vulnerabilities?

Scanning Tools

There are a lot of tools out there that help us do the scanning. In fact, a lot of these are built for defenders to defend their network, and adversaries can use them to do the scanning. OpenVAS, Nessus, Nmap, QualysGuard, Burp Suite, InsightVM and opencap are all tools and resources that can be used for this type of scanning.

Enumerating and Scoring Vulnerabilities

When our vulnerability scanning software is done scanning the systems, what it's going to do is enumerate those vulnerabilities. Enumerate, because there are actually identifiers out there that can identify very specific vulnerabilities.

One of those is the common vulnerability and exposure list, so this will give enumeration to those vulnerabilities and exposures. Something similar to that is the common weakness enumeration, or the CWE. These are two databases that identify all those vulnerabilities and weaknesses.

Then we also have two different scoring systems. The scoring systems help identify what the scores are, so we can identify what the risks are of each of those vulnerabilities or weaknesses. We have the common vulnerability scoring system, the CVSS, and the exploit prediction scoring system, the EPSS.