2KKUU7ita

202
Part IV: Hacking Operating Systems
All-in-one assessment tools
All-in-one tools perform a wide variety of security tests, including the following:
✓ Port scanning
✓ OS fingerprinting
✓ Basic password cracking
✓ Detailed vulnerability mappings of the various security weaknesses
that the tools find on your Windows systems
I use these tools in my work with very good results:
✓ GFI LanGuard (www.gfi.com/network-security-vulnerabilityscanner)
✓ QualysGuard (www.qualys.com)
Qualys’s cloud application service provider/software as a service (whatever
term you want to use these days) is very easy to use. Simply log in to the interface,
give it the IP addresses to scan, and tell it to go. The service has very
detailed and accurate vulnerability testing — it’s my all-time favorite for network/OS
vulnerability testing. Another scanner I’ve heard good things about is
Rapid7’s Nexpose (www.rapid7.com/vulnerability-scanner.jsp).
Task-specific tools
The following tools perform one or two specific tasks. These tools provide
detailed security assessments of your Windows systems and insight that you
might not otherwise get from all-in-one assessment tools:
✓ Metasploit (www.metasploit.com) for exploiting vulnerabilities that
such tools as QualysGuard and Nexpose discover to obtain remote
command prompts, add users, and much more
✓ NetScanTools Pro (www.netscantools.com) for TCP port scanning,
ping sweeps, and share enumeration
✓ ShareEnum (http://technet.microsoft.com/en-us/sys
internals/bb897442.aspx) for share enumeration
✓ TCPView (http://technet.microsoft.com/en-us/sysinternals/
bb897437.aspx) to view TCP and UDP session information
✓ Winfo (www.ntsecurity.nu/toolbox/winfo) for null session enumeration
to gather such configuration information as security policies,
local user accounts, and shares