Ravindra BagaleCourses & study guides मराठी Track your progress

20. Vulnerability Scanning and Assessment

20.2 Manual Lookup: searchsploit and Exploit-DB

By Last updated:

Chapter 19 chya -sV scan madhun aaplyakade versions aahet. Pratyek version sathi aapan known vulnerabilities shodhu shakto. Kali madhe Exploit-DB chi offline copy aahe, aani tyala shodhnyacha tool mhanje searchsploit.

searchsploit -u                          # update the local Exploit-DB copy
searchsploit vsftpd 2.3.4                # search by product and version
searchsploit apache 2.2.8
searchsploit samba 3.0.20
searchsploit -x unix/remote/49757.py     # read an entry (path from the results)
searchsploit -m unix/remote/49757.py     # copy it to the current folder to study
nmap -sV -oX msf2.xml 192.168.56.20 && searchsploit --nmap msf2.xml   # search every version from a scan

For every service you find, make a row in your notes:

Port Service and version Known issue CVE Source
21 vsftpd 2.3.4 Backdoor in that release CVE-2011-2523 NVD, Exploit-DB
... ... ... ... ...

Never run exploit code you have not read

Code downloaded from the internet can contain mistakes or even malware that attacks you. Read it first, understand what it does, and run it only against your lab. In the next chapters we use Metasploit modules, which are reviewed and maintained.

Ravindra Bagale's Tip

searchsploit shows many results, so students just take the first one. Check that the version matches exactly – an exploit for "Apache 2.2" will not work on "Apache 2.4". And always confirm the CVE on NVD.

Lab

Take the service list from your Chapter 19 scan of Metasploitable 2. For at least five services, search with searchsploit and look up the CVE on NVD. Fill in the table above with the CVSS score of each.

Using SearchSploit without crossing the line

SearchSploit shows public information about known vulnerabilities. Reading that information on your own lab is learning. Downloading an exploit and running it against someone else's system is a crime.

Defender workflow

When Nmap shows Apache httpd 2.4.49 on a server you own:

  1. searchsploit apache 2.4.49 to see known issues.
  2. Open the NVD page for the CVE and read the fixed version.
  3. Patch to the fixed version (or newer).
  4. Re-scan. Confirm the banner and package version changed.

Real examples

Global: Exploit-DB and Metasploit modules are studied by defenders to write detection rules (Snort, Suricata, Sigma). Indian company (sample): a CERT team at a PSU matches SearchSploit hits to their asset inventory, then opens patch tickets. They never "try the exploit" on production.

Recap

  • Search to understand and patch. Do not attack systems you do not own.

Defender's worksheet (do this today)

  1. Write the lesson title and date in your notebook.
  2. List three systems you own (VMs, personal projects, or lab apps) where this lesson applies.
  3. Run one safe command or checklist item from the lesson on a lab system only.
  4. Paste the command and its output under an Evidence heading.
  5. Write one fix you would give a teammate in two sentences.
  6. Write one mistake students make with this topic and how to avoid it.

More real-world pictures

Indian workplace (sample data)

Suppose we are a junior analyst at Tech Mahindra supporting a client SOC. After reading this lesson you add one detection or one hardening item to the team weekly checklist, with the owner name and a due date. That is how learning becomes operations.

Global practice

Public bodies such as CERT-In (India), CISA (US) and NCSC (UK) publish advisories that map to the same ideas: patch, least privilege, logging and user awareness. Bookmark one advisory feed and read it every Monday.

Home and family

Explain this lesson to a family member in four sentences without jargon. If they can repeat the main warning back to you, you understand it well enough to teach.

Connect to earlier chapters

Parts 1 to 9 built Linux, web servers, databases and cloud pieces. This lesson only makes sense when you can point to a concrete config file, package name or architecture box from those parts. If you cannot, revisit the matching earlier chapter before you practise any tool command.

Common mistakes

  • Skipping written permission just for a quick scan.
  • Practising on hostel or office Wi-Fi targets without authorisation.
  • Collecting tool output without writing the fix.
  • Copying exploit commands onto production to verify. Verification for defenders means checking versions and patches, not firing modules.

Recap

  • Evidence, fix, owner, date.
  • Own lab only.
  • Teach one other person the warning from this lesson.