Exploitation Reality

5 automated security scanners

Environmental Barrier Assessment

Purpose: The Environmental Barrier Assessment Scanner is designed to detect mitigating controls and exploitation prerequisites by analyzing exposed services, vulnerabilities, and threat intelligence feeds to identify potential security weaknesses in a given domain.

What It Detects:

Exposed Services: Identifies open ports and services using the Shodan API, with patterns like port\\s*:\\s*22|ssh.
Known Vulnerabilities: Checks for known exploited vulnerabilities listed in CISA KEV, matching patterns such as CVE-[0-9]{4}-[0-9]+.
Malware Indicators: Scans domain/IP reputation using the VirusTotal API, detecting indicators like malware, ransomware, or trojan.
Command and Control (C2) Activity: Detects potential C2 servers or malicious activities with patterns such as command\\s*(?:and|&)\\s*control, c2, or c&c.
Phishing and Credential Harvesting: Identifies phishing attempts and credential harvesting efforts, matching patterns like phishing or credential\\s+harvesting.

Inputs Required:

domain (string): Primary domain to analyze (e.g., acme.com).

Business Impact: This scanner is crucial for organizations aiming to secure their digital assets by identifying and mitigating potential security weaknesses in real time, which can significantly reduce the risk of data breaches and cyber threats.

Risk Levels:

Critical: Conditions that lead to critical severity include highly sensitive information exposure or direct access to critical infrastructure systems.
High: High severity findings involve significant vulnerabilities that could be exploited by adversaries with moderate skills, potentially leading to substantial damage.
Medium: Medium severity issues require attention as they can be exploited by low-skilled attackers and may lead to considerable disruptions.
Low: Low severity risks are typically informational in nature, indicating minor vulnerabilities or configurations that might not pose an immediate threat but should still be addressed for overall security improvement.
Info: Informational findings include general system configurations or software versions that do not directly affect security but could provide useful baseline information for ongoing monitoring and updates.

Example Findings:

A critical vulnerability in the domain’s web server configuration, which if exploited could lead to unauthorized access and data leakage.
High-severity malware indicators detected on multiple endpoints within the network, suggesting active exploitation attempts or potential future threats.

Exploitation Scaling Potential

Purpose: The Exploitation Scaling Potential Scanner is designed to identify wormable characteristics and mass exploitation features in a given domain by analyzing exposed services, vulnerabilities, and threat intelligence feeds. This helps organizations identify systems that could be exploited on a large scale, enhancing their security posture against potential cyber threats.

What It Detects:

Wormable Characteristics: Identifies CVEs known for their wormability and looks for indicators of self-replicating malware capabilities.
Mass Exploitation Features: Detects open services and ports that could be exploited by automated tools, searches for patterns indicating unpatched or vulnerable software versions.
Threat Intelligence Indicators: Scans Shodan, VirusTotal, CISA KEV, and other sources for known vulnerabilities and threats associated with the domain, checks for malicious activities reported on the dark web.
Vulnerability Patterns: Uses regex patterns to identify common vulnerability descriptions in threat intelligence feeds, looks for specific CVE identifiers and malware-related terms.
Exposure Indicators: Identifies indicators of data exposure, unauthorized access, or breaches, scans for patterns suggesting compromised systems or leaked information.

Inputs Required:

domain (string): Primary domain to analyze (e.g., acme.com)

Business Impact: This scanner is crucial for organizations looking to proactively identify potential vulnerabilities and threats that could be exploited on a large scale, allowing them to take immediate action to mitigate risks and protect their systems from cyber attacks.

Risk Levels:

Critical: Conditions where the identified vulnerability directly impacts critical infrastructure or highly sensitive data, with no viable workarounds available.
High: Conditions where the vulnerability could lead to unauthorized access or significant data exposure, requiring urgent attention for patching or mitigation.
Medium: Conditions where the vulnerability may be exploited but does not pose an immediate threat to critical systems, suggesting a need for planned remediation.
Low: Informal findings that do not significantly impact security posture but can still provide valuable insights for ongoing monitoring and improvement.
Info: Non-critical findings providing general information about potential risks or areas needing awareness training.

Example Findings:

The domain “acme.com” has been identified as having multiple open ports, including several well-known vulnerable services that could be exploited by automated tools.
Shodan scans reveal a significant number of known vulnerabilities associated with the domain, indicating potential risk areas for further investigation and remediation.

CVSS vs. Actual Exploitability

Purpose: The CVSS vs. Actual Exploitability Scanner is designed to evaluate the discrepancy between Common Vulnerability Scoring System (CVSS) scores and real-world exploitation rates by cross-referencing reported vulnerabilities with threat intelligence feeds to identify potential inaccuracies in scoring or underreported exploits.

What It Detects:

Identifies vulnerabilities listed in the NVD/CVE database that have high CVSS scores but no known real-world exploitation.
Detects vulnerabilities reported as exploited in threat intelligence feeds that have low or medium CVSS scores.
Cross-references identified vulnerabilities against the CISA Known Exploited Vulnerabilities (KEV) list to flag those known to be actively exploited and highlights discrepancies where vulnerabilities listed in KEV do not match expected CVSS severity ratings.
Searches Shodan for exposed services and vulnerabilities that may indicate active exploitation.
Utilizes VirusTotal API to assess domain/IP reputation for signs of malicious activity related to known vulnerabilities.
Scans dark web sources for mentions of the target domain or IP address in relation to exploited vulnerabilities, potentially identifying zero-day exploits or undisclosed vulnerabilities being discussed on underground forums.
Checks the reputation of associated IPs using AbuseIPDB to identify malicious activities and potential exploitation attempts.

Inputs Required:

domain (string): Primary domain to analyze (e.g., acme.com)

Business Impact: This scanner is crucial for organizations aiming to maintain a robust security posture by identifying vulnerabilities that may be overrated or underreported in terms of their actual risk level. Understanding the true exploitability and impact of vulnerabilities is essential for making informed decisions about patching, mitigation strategies, and resource allocation towards more critical areas.

Risk Levels:

Critical: Vulnerabilities with CVSS scores indicating a high severity but lacking evidence of real-world exploitation or being listed in KEV without matching the expected rating.
High: Vulnerabilities with CVSS scores suggesting significant risk, yet not reflecting active exploitation through threat intelligence feeds or Shodan searches.
Medium: Vulnerabilities where the CVSS score does not align with available evidence of their use in attacks as indicated by dark web discussions and reputation checks.
Low: Informational findings that do not directly impact security but may be indicative of ongoing or recent exploitation efforts, requiring monitoring for potential escalation.
Info: Findings that provide minimal actionable information but contribute to a broader understanding of the threat landscape related to known vulnerabilities.

Example Findings:

A vulnerability with a CVSS score of 9.0 is listed in the NVD/CVE database but has no reported real-world exploits, indicating potential inaccuracy in the CVSS score.
An actively exploited vulnerability (as indicated by threat intelligence feeds) is found to have a low CVSS score, suggesting an underreported exploit scenario that requires further investigation.

Authentication Bypass Factor

Purpose: The Authentication Bypass Factor Scanner is designed to identify potential vulnerabilities and access control weaknesses that could be exploited to bypass authentication mechanisms. This poses significant security risks by allowing unauthorized access to systems and data, highlighting areas of concern for enhancing overall security posture.

What It Detects:

CVE Indicators: Identifies known vulnerabilities related to authentication bypass using patterns like CVE-[0-9]{4}-[0-9]+.
Malware and Trojan Signatures: Looks for indicators of malware or trojan activities that could exploit authentication mechanisms.
Command and Control (C2) Indicators: Detects patterns related to command and control servers that might be used in conjunction with authentication bypass attacks.
Phishing and Credential Harvesting: Identifies phishing attempts or credential harvesting activities that could lead to authentication bypass.
Exposure Indicators: Looks for signs of data exposure or unauthorized access that might indicate vulnerabilities in the authentication process.

Inputs Required:

domain (string): Primary domain to analyze (e.g., acme.com)

Business Impact: This scanner is crucial as it helps in detecting potential security flaws in authentication mechanisms, which can lead to unauthorized access and exposure of sensitive information. Addressing these vulnerabilities promptly is essential for maintaining a secure environment against malicious activities.

Risk Levels:

Critical: Findings that directly compromise the integrity or availability of systems, such as critical CVE indicators or malware exploiting authentication bypass.
High: Vulnerabilities that significantly increase the risk of unauthorized access without requiring significant effort to exploit, such as exposure indicators and trojans targeting authentication mechanisms.
Medium: Vulnerabilities that could be exploited with moderate effort but still pose a notable security risk, like phishing or credential harvesting activities indicating potential bypass attempts.
Low: Informal findings that might suggest areas for improvement in the authentication process without immediate critical impact, such as exposure of non-sensitive data.
Info: Non-critical findings providing general information about system configurations but not directly affecting security unless exploited in conjunction with other vulnerabilities.

Example Findings:

A known CVE vulnerability that could be exploited to bypass authentication mechanisms (Critical).
Indicators of malware or trojans targeting the same mechanism, suggesting potential exploitation attempts (High).
Exposure of user credentials without encryption, which might indicate a weak point in the system’s security (Medium).

Vulnerability Chaining Potential

Purpose: The Vulnerability Chaining Potential Scanner is designed to detect potential chains of exploitation that could lead to significant security breaches by analyzing exposed services, vulnerabilities, and threat intelligence feeds. It aims to identify combined vulnerability impact and attack path enablement.

What It Detects:

Exposed Services Identification: Open ports and services are detected using the Shodan API, with an ability to identify default credentials or misconfigurations in exposed services.
Vulnerability Lookup: Known vulnerabilities associated with the domain/IP are retrieved from the NVD/CVE database, including checks for presence of CVEs listed in CISA KEV (Known Exploited Vulnerabilities).
Threat Intelligence Aggregation: Data is collected from VirusTotal API to assess domain/IP reputation and gather information on malicious activities, malware, and command-and-control servers.
IP Reputation Analysis: The reputation of associated IPs is evaluated using AbuseIPDB, identifying if IPs are known for malicious activity or have a high abuse score.
Potential Attack Path Identification: Collected data is analyzed to identify possible attack vectors and chaining opportunities, highlighting vulnerabilities that could be exploited in sequence to compromise systems.

Inputs Required:

domain (string): Primary domain to analyze (e.g., acme.com)

Business Impact: This scanner is crucial for organizations aiming to secure their digital assets by identifying potential security risks and enabling proactive mitigation strategies, ensuring that vulnerabilities are not exploited in a sequence leading to significant breaches.

Risk Levels:

Critical: Findings that directly lead to high-impact vulnerabilities being actively exploited or critical systems compromised.
High: Vulnerabilities that can be easily exploited with minimal effort and could significantly impact system functionality or data security.
Medium: Vulnerabilities that require more complex exploitation techniques but still pose a significant risk if not addressed promptly.
Low: Informal findings that do not directly compromise security but may indicate areas for improvement in the information security posture.
Info: Non-critical vulnerabilities with minimal impact, typically used for informational purposes to enhance overall security awareness and practices.

Example Findings:

A critical vulnerability (e.g., CVE-2021-44228) affecting a widely used software component that could be exploited remotely, leading to unauthorized access and potential data theft.
A high risk of exploitation through misconfigured services exposing sensitive information or allowing remote code execution due to default credentials being unchanged from factory settings.