Internal Vulnerability Scanner

Infrastructure testing for open ports

Internal Vulnerability Scans usually begin with reconnaissance to gauge and map all network entry points in a target system. The first priority is often to check for open ports that may expose assets to attackers with local network access. Of course, these ports should not be publicly accessible at all and pose a great risk to internal security.

You need to know if the network perimeter has any open ports and, if so, where they are. In other words, you not only need port discovery, but also mapping. Pentest-Tools.com has multiple ways of solving this problem of accurate port detection and checking for you.

As part of our suite of Reconnaissance tools, Pentest-Tools includes a separate Port Scanner and a UDP Port Scanner, to account for differing port scan techniques. These online port scanners detect open ports and running services. They also perform OS fingerprinting on target IP addresses or hostnames. Finally, they check firewall rules and verify whether your services are accessible from the web.

Both port scanners are based on Nmap, the world's most famous port scanner. Using an online and optimized version of the Nmap port scanner, rather than one on a local machine, produces an external view of our systems. For internal vulnerability scans, it is vital that firewalls and network restrictions are included in scan results, to gain the vantage point of a malicious hacker.

Network perimeter assessment with a top quality scanner

The next stage in an Internal Vulnerability Scan involves using network vulnerability scanners for infrastructure testing. The Pentest-Tools.com solution for assessing the network perimeter is the Network Vulnerability Scanner. Its role is to discover critical vulnerabilities in widely used software, outdated network services, missing security patches, and badly configured servers.

The network perimeter is what divides your internal network assets from the outside. A network vulnerability scanner accesses and exposes internal network services. It then maps all those services and reports on any detected vulnerabilities. This is a sample Network Vulnerability Scanner report:

Two even more specialized network vulnerability scanners

The Network Vulnerability Scanner with OpenVAS is considered one of the best open-source network security scanners available. To make your workflow even more powerful, Pentest-Tools.com includes two additional network vulnerability scanners in your arsenal:

• The SSL/TLS Scanner – SSL (Secure Sockets Layer) and TLS (Transport Layer Security) are security protocols that use cryptographic methods to produce secure communications across a network. This scanner discovers relevant configuration issues and vulnerabilities associated with these protocols, such as POODLE, Heartbleed, DROWN, ROBOT, and others.
• The DNS Server Scanner – DNS (Domain Name System) Zone Transfer is a type of database transaction that enables administrators to replicate DNS databases across DNS servers. The DNS Server Scanner checks whether the name servers of the target domain are vulnerable to DNS Zone transfer. It also retrieves the full DNS Zone file and checks for other vulnerabilities in DNS servers.

An automatic exploiter tool that validates internal vulnerabilities

Sniper - Automatic Exploiter provides you with a way to get proof for validating that critical, high-impact CVEs (Common Vulnerabilities and Exposures) are exploitable on the target system. You can run full, controlled, automatic exploitation while leaving the target system unaltered and clean.

The Pentest-Tools.com Sniper automatically filters out the noise that vulnerability scanners create so you can gain Remote Code Execution (RCE) and evidence of exploitation in under two minutes. It’s also helpful for weeding out false positives. At the end, Sniper provides a list of tool activities, extracted data (called artefacts), and exploitation details.

How does it work with internal vulnerability scans? Sniper Auto-Exploiter:

• Mimics real-world internal exploits and attack techniques to determine the truly vulnerable systems
• Gains RCE (Remote Code Execution) on vulnerable targets
• Automatically runs post-exploitation to extract interesting data as solid proof for vulnerability validation

A weak password auditor for strong authentication

Default passwords and other weak credentials pose a larger problem for internal networks than most business leaders realize. They are frequently and consistently in lists of top ten internal vulnerabilities. And a single weak password could expose the entire network to security threats involving data-hungry malware.

Finding them manually is ineffective and time consuming, especially if you want to cover the entire attack surface. With the Pentest-Tools.com Password Auditor, you can automatically find weak passwords in network services (e.g. SSH, FTP, MySQL), web pages (web forms), and web applications. It also helps you quickly detect services that require authentication (login forms and other password protected pages).