Task 1: SearchSploit OpenSSH Vulnerabilities

Step 1

• Make sure Kali is running and the network adapter has internet connectivity.

Step 2

• Open the terminal and use SearchSploit to search for vulnerabilities in OpenSSH 7.7 for Rob-You-Way Industrial Textiles. Note how many potential vulnerabilities can be exploited:

Step 3

• Open both exploit-db.com and cvedetails.com to find the same exploits in Kali and determine the level of severity.

Step 4

• First, use Exploit Database and search for OpenSSH in the search bar. You will notice the letters D, A, and V to the left. D is for download, A is for vulnerable application, and V is for verified. Click on the second username enumeration.

Step 5

• You will now be able to identify and use the CVE number on the CVE Details website from Step 3.

Step 6

• Notice the severity levels in the highlighted section ranging from 0 to 10. The higher the number, the more threatening to a system, while lower numbers are less threatening. This is an industry-standard scoring system. Type the CVE number from Step 5 in the search bar.

Step 7

• Scroll past the ads to find the correct CVE information.

Step 8

• The CVSS score is in the middle at 5.0. Note vulnerabilities using the information from your objective for the CIO of Rob-You-Way Industrial Textiles. Proceed to the next task, the Apache server.

Task 2: SearchSploit Apache Vulnerabilities

Step 1

• After searching for the OpenSSH vulnerabilities, use SearchSploit to locate vulnerabilities in Apache 2.4 and note your findings.

Step 2

• Again, start with exploit-db.com to search for your list and get CVE numbers on the CVE Details webpage. Notice many are unverified, and not all are Apache 2.4. There are also five verified exploits. Open the denial of service and cross-site scripting exploit CVE.

Step 3

• Use the CVE from the cross-site scripting on the CVE Details site to find necessary information for the CIO. Notice the DoS vulnerability does not have a CVE number.

Step 4

• The CVSS score is 4.3. Note the vulnerabilities and information from your objective to notify the CIO of Rob-You-Way Industrial Textiles about the Apache server.
• Note: More exploits can be found in Lab Task 2, Step 2. You will find different score levels that may be of more importance to the CIO of RobYou-Way Industrial Textiles.

Step 5

• Congratulations on completing the lab and learning about different vulnerabilities with their CVSS scores! The initial research was done with the use of Kali SearchSploit and the websites provided.