Vulnerability_assessment

General Vulnerability Scanners
Nessus

Comprehensive scanning for vulnerabilities, misconfigurations, and compliance issues.
Website: nessus.org
Example command:

nessus -q -i example.com -o report.html
OpenVAS

Open-source vulnerability scanner for networks and servers.
Example usage:

sudo gvm-setup
gvm-start
QualysGuard

Cloud-based scanner with advanced vulnerability and compliance checks.
Website: qualys.com
2. Network Scanners
Nmap

Used for port scanning, service detection, and vulnerability assessment with scripts.
Example commands:

nmap -A example.com
nmap --script vuln example.com
Masscan

High-speed network port scanner.
Example:
masscan -p1-65535 example.com --rate=1000
3. Web Application Vulnerability Scanners
Nikto

Detects outdated software, misconfigurations, and vulnerabilities in web servers.
Example:

nikto -h http://example.com
OWASP ZAP (Zed Attack Proxy)

Intercepting proxy and automated web vulnerability scanner.
Useful for testing SQLi, XSS, and more.
Example setup: Run ZAP in GUI or CLI and proxy traffic through it.
Burp Suite

Professional-grade tool for manual and automated vulnerability assessments of web apps.
Usage: Proxy traffic, identify vulnerabilities (like XSS, SQLi).
Acunetix

Commercial web vulnerability scanner focusing on XSS, SQLi, and CSRF.
Website: acunetix.com
4. Specialized Scanners
Database Vulnerabilities
SQLmap
Automates the detection and exploitation of SQL injection flaws.
Example:
sqlmap -u "http://example.com/product?id=1" --dbs
CMS Vulnerabilities
WPScan

Scans WordPress sites for plugins, themes, and configuration vulnerabilities.
Example:

wpscan --url example.com --enumerate p
Droopescan

Focuses on Drupal, Joomla, and other CMS platforms.
Example:

droopescan scan drupal -u example.com
5. Cloud and Container Vulnerability Tools
Trivy

Scans Docker images, file systems, and Git repositories for vulnerabilities.
Example:

trivy image example/image:tag
Scout Suite

Multi-cloud security auditing tool for AWS, Azure, and GCP.
Example:

scout --provider aws
Anchore

Container image scanning for compliance and vulnerabilities.
Website: anchore.com
6. Endpoint Scanners
Lynis

Security auditing and hardening tool for Linux/Unix systems.
Example:

lynis audit system
Microsoft Baseline Security Analyzer (MBSA)

Basic security assessment for Windows systems.
Example: Use the GUI or CLI for system scans.
7. Code and Dependency Scanners
Bandit

Security analyzer for Python code.
Example:

bandit -r /path/to/code
Snyk

Scans code dependencies for vulnerabilities.
Example:
snyk test
Semgrep

Lightweight static analysis tool for security and code quality checks.
Example:

semgrep --config=p/security /path/to/code
8. Wireless Security Tools
Aircrack-ng

Cracks WEP/WPA/WPA2 keys in wireless networks.
Example:

airodump-ng wlan0
aircrack-ng -w /path/to/wordlist capture_file.cap
Wireshark

Packet analyzer for inspecting traffic for vulnerabilities.
9. Social Engineering and OSINT
theHarvester

Gathers emails, subdomains, and other OSINT data.
Example:
theHarvester -d example.com -b google
Maltego

Graphical OSINT tool for mapping relationships between entities.
Spiderfoot

Automated OSINT gathering and analysis.
Example:

spiderfoot -l 5000
10. Exploit Validation
Metasploit Framework

Exploitation framework for validating vulnerabilities.
Example:

msfconsole
use exploit/windows/smb/ms17_010_eternalblue
set RHOST example.com
exploit
SearchSploit

Search for exploit code in the Exploit-DB database.
Example:

searchsploit apache 2.4