how to run a vulnerability test on a domain
HELLO,
i want to run some tests and expose the vulnerabilities of our domain from the internet. We dont want to install any tools yet on our servers but we can install any tool needed or run anything from the internet against out domain.
I would like to see if there is any way someone from the internet to see servers on our domain, or connect , or see if we have any ports open , or if anybody from the internet can see if we have ports open..etc
are there any tools or sites i can run these programs or tools ?
i run a re[port from the http://www.dnsreport.com/ which is really nice...
is there anything else ? (it is very important to us)
thanks.
i want to run some tests and expose the vulnerabilities of our domain from the internet. We dont want to install any tools yet on our servers but we can install any tool needed or run anything from the internet against out domain.
I would like to see if there is any way someone from the internet to see servers on our domain, or connect , or see if we have any ports open , or if anybody from the internet can see if we have ports open..etc
are there any tools or sites i can run these programs or tools ?
i run a re[port from the http://www.dnsreport.com/ which is really nice...
is there anything else ? (it is very important to us)
thanks.
you can run nmap (port mapper) or nessus (vulnerability checks) if you want, that will help you and they have good reports. you will need a pc outside your network with this two tools to run them.
ASKER
note : the "target" network is Windows 2003 based
Hey,
Maybe the Microsoft Baseline Security Analyzer can help.
http://www.microsoft.com/technet/security/tools/mbsa2/default.mspx
Maybe the Microsoft Baseline Security Analyzer can help.
http://www.microsoft.com/technet/security/tools/mbsa2/default.mspx
MBSA2 will just tell you some basic informations. I agree with mahe: the tools of the trade are nessus and nmap, if you want to stay on the freeware side of the moon.
If you want some commercial tools, best in my opinions are CoreImpact and Retina.
Some examples:
nmap -n -A -P0 -p- -T Agressive -iL nmap.targetlist -oX nmap.syn.results.xml
nmap -sU -P0 -v -O -p 1-30000 -T polite -iL nmap.targetlist > nmap.udp.results
nmap -sV -P0 -v -p 21,22,23,25,53,80,443,161 -iL nmap.targets > nmap.version.results
These examples come from http://www.vulnerabilityassessment.co.uk/Penetration%20Test.html . You may find this site interesting.
Anyway, if you are really concerned about your security you should hire some security consultants, since doing it yourself might leave you with the wrong assumption you're safe. A professional pentest or security assessment is more than "a run of nessus" :D
If you want some commercial tools, best in my opinions are CoreImpact and Retina.
Some examples:
nmap -n -A -P0 -p- -T Agressive -iL nmap.targetlist -oX nmap.syn.results.xml
nmap -sU -P0 -v -O -p 1-30000 -T polite -iL nmap.targetlist > nmap.udp.results
nmap -sV -P0 -v -p 21,22,23,25,53,80,443,161 -iL nmap.targets > nmap.version.results
These examples come from http://www.vulnerabilityassessment.co.uk/Penetration%20Test.html . You may find this site interesting.
Anyway, if you are really concerned about your security you should hire some security consultants, since doing it yourself might leave you with the wrong assumption you're safe. A professional pentest or security assessment is more than "a run of nessus" :D
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.