Scribd
Upload
32 views

Assignment 2 Nielit

Cyber security

Uploaded by

srsjnb
Copyright
© © All Rights Reserved
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
32 views

Assignment 2 Nielit

Cyber security

Uploaded by

srsjnb
Copyright
© © All Rights Reserved
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
You are on page 1/ 5

ASSIGNMENT -2

Submitted By
Shubham Raj Satyam

Q. (1) What is vulnerability scan? How do you ensure the accuracy


of your scans?
Ans: Vulnerability scanning is an automated process that identifies
potential security weaknesses in systems, networks, and applications. It
scans for known vulnerabilities, misconfigurations, and other issues that
could be exploited by attackers
To ensure the accuracy of a vulnerability scan, you can:
Verify the scanner
Check the scanner's documentation to confirm it can check for security
issues in your organization's software and applications.
Compare results
Compare the scan results with other sources of information, such as logs,
reports, or manual tests.
Review the scan report
Check for false positives or false negatives that may skew the
interpretation of the results.
Validate against benchmarks
Assess the consistency of findings across different scans and validation
against known vulnerabilities or security benchmarks.

Q. (a) Do a Vulnerability Analysis on metaspoilatable?


Ans: Reconnaissance to gather preliminary information. Scanning and
enumeration to identify services and potential vulnerabilities. Detailed
analysis and exploitation of vulnerabilities . Documentation of each step,
findings, and recommendations for mitigation.
Q. (b) How to use Searchsploit in Kali Linux?
Searchsploit is a command-line utility for Kali Linux that allows users to
search the Exploit Database for potential vulnerabilities and exploits. It
is a handy tool for penetration testers and security researchers. Here’s a
step-by-step guide on how to use Searchsploit in Kali Linux:
1. Update Exploit-DB Repository
Before using Searchsploit, it’s good practice to update the local exploit
database to ensure you have the latest exploits.
sudo searchsploit -u
2. Basic Search
To perform a basic search, simply type searchsploit followed by your
search term.
searchsploit [search_term]
For example, to search for exploits related to "Apache":
searchsploit apache
3. Using Advanced Search Options
Searchsploit supports various options to refine your search:

Exact Matches Only (-e or --exact): Search for exact matches.


searchsploit -e apache
Case Sensitive Search (-s or --case-sensitive): Perform a case-sensitive
search.
searchsploit -s Apache
Exclude Non-Exploits (-x or --exclude): Exclude non-exploits like
shellcodes.
searchsploit -x apache
Search by EDB-ID (-j or --json): Output results in JSON format.
searchsploit -j apache
4. Viewing Exploit Details
To view details of a specific exploit, use the -p option followed by the
path or ID of the exploit.
searchsploit -p exploits/webservers/apache/httpd/40700.txt
5. Copy Exploit to Current Directory
To copy an exploit to your current working directory, use the -m option
followed by the path or ID of the exploit.
searchsploit -m 40700
6. Searching Using Multiple Keywords
You can search using multiple keywords by enclosing them in quotes.
searchsploit "apache buffer overflow"
7. Combining Options
You can combine various options to refine your search further.
searchsploit -s -e "apache 2.4"
8. Help and Documentation
For more options and detailed usage, you can refer to the help
documentation.
searchsploit -h
Q. (c) Explain any 5 Vulnerability Analysis Tools?
Ans: Burp Suite:A web vulnerability scanner that can check for
vulnerabilities like SQL injection, OS command injection, and cleartext
password submission. It also has a web application crawler that can
analyze applications and report on their volatile content.

Nmap
A vulnerability scanning tool that includes features like OS detection,
version detection, and flexible scripting. It can also integrate with other
security and management tools.

Netsparker
A vulnerability scanner tool that can find vulnerabilities in web
applications and websites, including standard vulnerabilities like SQL
injection and cross-site scripting. It's compatible with all languages.

Manageengine Vulnerability Manager Plus


A vulnerability scanning, compliance, and remediation tool that can
provide visibility into security risks like harmful software, web server
misconfigurations, and security misconfigurations.

Probely
A lesser-known but capable tool that continuously scans web
applications and can generate PCI-DSS and OWASP compliance
reports. If it finds a vulnerability, it can suggest remedial actions with
code snippets for developer.

You might also like