Network Security Testing

Question 1

Vulnerability Scanners

Answer 1

A vulnerability scanner assesses computers, computer systems, networks or applications for weaknesses.

Vulnerability scanners can help to automate security auditing by scanning the network for security risks and producing a prioritized list to address vulnerabilities.

Question 2

What types of vulnerabilities do scanners look for?

Answer 2

• Use of default passwords (common passwords)
• Missing patches
• Open ports
• Misconfiguration in operating systems and software
• Active IP addresses, including any unexpected devices connected

Question 3

What are some commonly used vulnerability scanners on the market?

Answer 3

• Nessus
• Retina
• Core Impact
• GFI LanGuard

Question 4

Categories of scanners

Answer 4

• Network scanners
• Application scanners
• Web application scanners

Question 5

Network scanners

Answer 5

Probe hosts for open ports, enumerate information about users and groups and look for vulnerabilities on the network.

Question 6

Application Scanners

Answer 6

Access application source code to test an application from the inside.

Question 7

Web application scanners

Answer 7

Identify vulnerabilities in web applications

Question 8

Intrusive scans

Answer 8

Try to exploit vulnerabilities and may even crash the target.

Question 9

Non-intrusive scan

Answer 9

Will try not to cause any harm to the target.

Question 10

credentialed scan

Answer 10

usernames and passwords provide authorised access to a system, allowing the system to harvest more information.

Question 11

Non-credentialed scan

Answer 11

less invasive and give an outsider’s point of view.