8_vulnerability_analysis.xml

<?xml version="1.0"?>

<scenario xmlns="http://www.github/cliffe/SecGen/scenario"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.github/cliffe/SecGen/scenario">

  <name>Vulnerability Analysis</name>
  <author>Z. Cliffe Schreuders</author>
  <description>
# Introduction
It is important for organisations to manage the security of their systems and for security professionals to efficiently scan networks for vulnerabilities. Vulnerability assessment is a critical practice aimed at identifying and addressing weaknesses in computer systems. This process is instrumental in safeguarding networks and data from potential threats and attacks. In this lab, you will explore a range of industry-standard tools, such as Nmap, Nessus, and Nikto, to evaluate the security posture of vulnerable services. The lab provides a hands-on experience that will equip you with the skills and knowledge to detect vulnerabilities, assess their severity, and understand the importance of using different tools for comprehensive security assessments.

Throughout this lab, you will learn how to use Nmap and its Nmap scripting engine (NSE) to perform vulnerability scanning, discover potential weaknesses in a target system, and gain insights into the ethical hacking and penetration testing process. You will also explore Nessus, a commercial vulnerability scanner, and understand how it operates, what vulnerabilities it can identify, and how to interpret the results. Additionally, you will utilize Nikto, a web vulnerability scanner, to assess the security of web servers, identifying critical vulnerabilities. By completing tasks like initiating scans, analyzing results, and considering the limitations of automated tools, you will gain a practical understanding of vulnerability assessment and the role it plays in strengthening cybersecurity.

  </description>
  <lab_sheet_url>https://docs.google.com/document/d/1rdNcOmYOjsRu97Gh3ds8HbTpORGxbMcd2Q7U4TATIbw/edit?usp=sharing</lab_sheet_url>

  <type>ctf-lab</type>
  <type>lab-sheet</type>
  <difficulty>easy</difficulty>

  <CyBOK KA="SOIM" topic="PENETRATION TESTING">
    <keyword>VULNERABILITY ANALYSIS / VULNERABILITY SCANNING</keyword>
    <keyword>AUDIT APPROACH</keyword>
    <keyword>PENETRATION TESTING - SOFTWARE TOOLS</keyword>
    <keyword>PENETRATION TESTING - ACTIVE PENETRATION</keyword>
  </CyBOK>
  <CyBOK KA="MAT" topic="Attacks and exploitation">
    <keyword>EXPLOITATION</keyword>
  </CyBOK>

  <system>
    <system_name>linux_server</system_name>

    <base distro="Debian 12" type="desktop" name="KDE"/>

    <input into_datastore="IP_addresses">
      <!-- 0 linux server -->
      <value>172.16.0.2</value>
      <!-- 1 kali -->
      <value>172.16.0.3</value>
    </input>

    <!-- vulnerable distcc server -->
    <vulnerability cve="CVE-2004-2687">
      <input into="strings_to_leak">
        <generator type="flag_generator" />
      </input>
      <input into="leaked_filenames">
        <value>flag</value>
      </input>
    </vulnerability>
    <!-- vulnerable wordpress -->
    <vulnerability module_path=".*/(wordpress_4x)">
      <input into="IP_address">
        <datastore access="0">IP_addresses</datastore>
      </input>
    </vulnerability>
    <!-- vulnerable IRC server -->
    <vulnerability module_path=".*/unrealirc_3281_backdoor"/>

    <!-- sudo priv escalation. -->
    <vulnerability module_path=".*/sudo_baron">
      <input into="strings_to_leak">
        <generator type="flag_generator" />
      </input>
      <input into="leaked_filenames">
        <value>flag</value>
      </input>
    </vulnerability>

    <network type="private_network">
      <input into="IP_address">
        <datastore access="0">IP_addresses</datastore>
      </input>
    </network>
    <input into_datastore="spoiler_admin_pass">
      <generator type="strong_password_generator"/>
    </input>
    <build type="cleanup">
      <input into="root_password">
        <datastore>spoiler_admin_pass</datastore>
      </input>
    </build>

  </system>

  <system>
    <system_name>kali</system_name>
    <base distro="Kali" name="Licensed Tools"/>

    <utility module_path=".*/parameterised_accounts">
      <input into="accounts">
        <value>{"username":"kali","password":"kali","super_user":"true","strings_to_leak":[],"leaked_filenames":[]}</value>
      </input>
    </utility>

    <utility module_path=".*/gcc"/>
    <utility module_path=".*/metasploit_framework"/>
    <!-- <utility module_path=".*/armitage"/> -->
    <utility module_path=".*/exploitdb"/>
    <utility module_path=".*/handy_cli_tools"/>
    <utility module_path=".*/nmap"/>
    <utility module_path=".*/nikto"/>

    <network type="private_network" >
      <input into="IP_address">
        <datastore access="1">IP_addresses</datastore>
      </input>
    </network>
    <build type="cleanup">
      <input into="root_password">
        <datastore>spoiler_admin_pass</datastore>
      </input>
    </build>

  </system>

</scenario>