Guiding Questions

Outputs

References and resources for Vulnerability Scanning and Analysis

Vulnerability Analysis:

• Standard: "Vulnerability Analysis - Research Phase" (Penetration Testing Execution Standard)

• Framework: "Vulnerability Assessment" (http://www.vulnerabilityassessment.co.uk)

• Resource: Vulnerability Databases (SAFETAG)

• Security Advisories: [^Microsoft_Security_Bulletin]^,¹^,²^,³^,⁴^,⁵

---

1. ^ind_univ_external_advisories↩↩
2. ^OSS_Security_advisories↩↩
3. ^CERT_CC_Advisories↩↩
4. ^security_tracker↩↩
5. ^mozilla_vulns↩↩

Vulnerability Databases:

• Standard Vulnerability Analysis - Research Phase (Penetration Testing Execution Standard)

• Framework Vulnerability Assessment (http://www.vulnerabilityassessment.co.uk)

• Database "Open Sourced Vulnerability Database"

• Database "CVE Details"

• Database Search CVE and CCE Vulnerability Database

• Database "Threat Explorer"

• Database "The Exploit Database"

• Database "Security Focus Vulnerability Search"

• Poster Ultimate Pen Test 2013 (SANS Institute)

• Security Advisories [^Microsoft_Security_Bulletin]^,¹^,²^,³^,⁴^,⁵

---

1. ^ind_univ_external_advisories↩↩
2. ^OSS_Security_advisories↩↩
3. ^CERT_CC_Advisories↩↩
4. ^security_tracker↩↩
5. ^mozilla_vulns↩↩

Website Vulnerability Scanning:

• Site: "OWASP ZAP Project Site" (OWASP)

• Guide: "The OWASP Testing Project Guide" (OWASP)

• User Guide: "OWASP Zap User Guide" (Google Code)

• Video Tutorials: "OWASP ZAP Tutorial Videos" (Google Code)

• Guide: "7 Ways Vulnerability Scanners May Harm Website(s) and What To Do About It" (White Hat Sec Blog)

• Article: "14 Best Open Source Web Application Vulnerability Scanners" (InfoSec Institute)

System Vulnerability Scanning:

• Project Site: "OpenVAS Project Site" (OpenVAS)

• Manual: "OpenVAS Compendium" (OpenVAS)

• Guide: "Creating OpenVAS "Only Safe Checks" Policy"

• Guide: "How To Use OpenVAS to Audit the Security of Remote Systems on Ubuntu 12.04" (Digital Ocean)

• Guide: "Getting Started with OpenVAS" (Backtrack Linux)

• Guide: "Setup and Start OpenVAS" (OpenVAS)

• Video Guide: "Setting up OpenVAS on Kali Linux" (YouTube)

• ListServ: "OpenVAS Discussion ListServ" (OpenVAS)

• Comparison: "Nessus, OpenVAS and Nexpose VS Metasploitable" (HackerTarget)

VoIP Security:

• Guide: "VoIP Security Checklist" (ComputerWorld)
• Overview: "The Vulnerability of VoIP" (Symantec)
• Research: "Researchers find VoIP phones vulnerable to Simple Cyber attacks" (Security Intelligence)
• Tool: "Vsaudit (Eurialo)" (Eurialo)

Overview: "Two attacks against VoIP" (Symantec)

• Overview: VOIP analysis Fundamentals(Wireshark)
• Tool: WireShark VOIP Capabilities

Incident Handling Resources:

• Guide: "Six Stages of Incident Response" (CSO Online: Anthony Caruana)

• Guide: "Threat Hunting Project" (http://www.threathunting.net)