Overview of Vulnerability Analysis Tools

If you open the Kali Linux Applications list, you will find that there are four subcategories under Vulnerability Analysis: Cisco Tools, Fuzzing Tools, Stress Testing, and VOIP tools. However, one major tool is missing there: OpenVas. In the next section, you will install OpenVas and see how it works.

How to Use OpenVas

Once OpenVas has been installed, it will show up in the Kali Linux Applications listing, as shown in Figure 10-1.

Once this code has been executed on the terminal, OpenVas will open in your Kali Firefox browser. It will ask for security certification; just accept the self-signed SSL certificate and enter the credentials for the admin user (Figure 10-2).

Enter the password admin and log in to the Dashboard of OpenVas, where you can start scanning the vulnerabilities of any target (Figure 10-3).

The Dashboard shows many categories in the top menu. Click the Scan link to open the Scan page. In the top-left section of the Scan page you will find three small colorful buttons. Click the middle one, which is violet.

This will open a new window and ask for the target address (Figure 10-4).

Don’t provide any live system’s IP address unless you have the proper permission to do this. It is better to provide the host machine’s IP address or your Kali Linux virtual machine’s IP address here so you can get an immediate scan report (Figure 10-5).

Otherwise, this takes a long time to process.

It usually takes two to three hours to scan a local IP address. In the case of a remote address, it might take even longer to finish the job (Figure 10-6).

You do not need to point your browser to https://127.0.0.1:9392; it will automatically detect the system after a proper installation. It will open in your Kali Linux Firefox browser, and you can hunt for information that is vulnerable. You can use this tool mainly for gathering knowledge about system vulnerabilities that you can then later rectify.

How to Use Nikto

For detecting vulnerabilities in any web application, a simple yet great tool is Nikto. It comes installed by default, so you will find it in the Web Application Analysis category. Just click the Nikto link, and Nikto will open in your terminal.

These lines state the server status and how it has vulnerabilities since the “anti-clickjacking X-Frame-Options header is not present” and the “X-XSS-Protection header is not defined.” This means on a live network, some form of XSS attacks could happen.

I have a few more vulnerabilities because I have kept a PHP file called info.php on my localhost server, and it uses the phpinfo() function .

Nikto is actually suggesting that I remove the info.php file . OSVDB-3233 is a signal for that. This is one of the information-leaking pages, which should not reside where it is now.

How to Use Vega

Another great tool for vulnerability analysis is Vega. It is a free and open source scanner and testing platform that test the security of any web application. The advantage of Vega is that it is GUI based and platform independent. It runs on Linux as well as on Windows. It can help you detect all the vulnerabilities present in any web application whether it is SQL injection or XSS cross-site scripting.

Once the installation is complete, Vega shows up in the Web Application Analysis category in the Kali Linux virtual machine (Figure 10-7).

Click the link to open Vega.

Once it opens, you will notice a red button in the top-left corner. Click it and you will be asked for the scan target. You need to enter the base URI of any target (Figure 10-8).

I have already installed the DVWA web application in the DVWA-master folder, so I enter the URI and click the Next button. The tool will ask for the selection of any modules, and I have chosen for the injection module (Figure 10-9).

Now Vega will start scanning the target (Figure 10-10).

After the initial scan is complete (Figure 10-11), Vega normally gives you a lot of significant information, such that it has found a session cookie without a flag, or has detected a directory listing, a blank body, PHP error, etc.

On the left side of the Scan Alerts panel, if you click the High button, the tool shows seven alerts, and they are serious enough to invite trouble (Figure 10-12). The vulnerability analysis by Vega tells you that it detected a form with a password input field that submits to an insecure HTTP target.

It also says that the password can be seen by a network sniffer quite easily. In fact, in the next section, by using Burp Suite, you will be able to see that.

Vega is nice because it has an automated crawler and vulnerability scanner, it has a consistent user interface, it can intercept the proxy, and the content analysis tool is strong. You have not yet set the proxy so that all the web traffic can go through Vega.

Therefore, in the next section, you will set up the proxy of the web browser so that all the traffic can go through the Burp Suite vulnerabilities and web application analysis tool.

How to Use Burp Suite

Security professionals use Burp Suite to intercept HTTP and HTTPS traffic; however, a penetration tester can use it for various other functions. It is an integrated platform for performing security testing of vulnerabilities and web application analysis. It has many tools incorporated into one application so that they can work in synchronization to support the entire process. It can do the initial mapping, and after that, it can analyze the application’s attack surface. Once the basic tasks are done, it can find and exploit all the security vulnerabilities.

As you can guess, Burp Suite is an extremely powerful tool that can do many things in one go. Security consultants usually use the professional version, which is more feature rich, although the free community edition is powerful too. It comes with Kali Linux, and it allows you to combine innovative manual techniques with state-of-the-art automation.

Burp Suite in Kali lets you use a spider to crawl an application. In the free version, you don’t get the vulnerability scanner, but you get the intruder tool.

Let’s start Burp Suite (Figure 10-13).

I already have an application ready for testing. Before the testing starts, you need to configure proxies to access the Internet. You will do this manually (Figure 10-14). Go to the preference section of the Firefox web browser and open the network settings. Set the “Manual proxy configuration” as an HTTP proxy to 127.0.0.1, and choose 8080 as the port. From now on, all traffic you request through the Firefox web browser will go through Burp Suite.

Now you can start testing. Let’s open http://192.168.2.2/DVWA-master in the Firefox browser. Burp Suite starts crawling the web application (Figure 10-15).

Once you have logged in to your application, Burp Suite starts giving you signals; now you can watch the requests you have made in your web browser (Figure 10-16).

If you double-click the login.php file of your application, you will see all the features that the free version of Burp Suite provides (Figure 10-17).

You can send a URI to the intruder and see the result. The tool shows everything such as the username, the password, and even the hidden token the form has used (Figure 10-18).

You can create your own web application and try to make it as secure as possible so that you can use Burp Suite on it and find all the vulnerabilities. The same thing applies for your client; you can enhance the security level according to the Burp Suite report.