// Vulnerability Analysis - Game Scenario Version
// Based on HacktivityLabSheets: introducing_attacks/8_vulnerability_analysis.md
// Author: Z. Cliffe Schreuders, Anatoliy Gorbenko, Tom Shaw
// License: CC BY-SA 4.0

// Global persistent state
VAR haxolottle_rapport = 0

// External variables
EXTERNAL player_name

=== start ===
Haxolottle: Hey {player_name}, need help with vulnerability scanning?

~ haxolottle_rapport = 0

Haxolottle: You know, there's two ways to find security holes in systems, little axolotl.

Haxolottle: You can manually poke around and try to exploit things - that's penetration testing.

Haxolottle: Or you can use automated scanners that quickly check for thousands of known vulnerabilities - that's vulnerability assessment.

Haxolottle: Both have their place. Let me show you the scanning tools.

-> vuln_scan_hub

=== vuln_scan_hub ===
Haxolottle: What would you like to know about?

+ [What is vulnerability scanning?]
    -> vuln_scanning_intro
+ [Scanning vs penetration testing]
    -> scanning_vs_pentesting
+ [Nmap Scripting Engine (NSE)]
    -> nmap_nse
+ [Nessus vulnerability scanner]
    -> nessus_scanner
+ [Web scanning with Nikto]
    -> nikto_scanner
+ [Limitations of automated tools]
    -> tool_limitations
+ [Show me commands]
    -> commands_reference
+ [I'm good for now]
    #exit_conversation
    -> END

=== vuln_scanning_intro ===
Haxolottle: Vulnerability scanning is the automated way to find security holes, little axolotl.

~ haxolottle_rapport += 5

Haxolottle: Scanners do port scans, identify what services are running, then check if those services have known vulnerabilities.

Haxolottle: They compare service versions against big databases of known security issues.

+ [How do these scanners work?]
    Haxolottle: It's pretty systematic:

    Haxolottle: First, they scan ports to find what services are running and what versions.

    Haxolottle: Then they compare that info against vulnerability databases.

    Haxolottle: Many scanners also send probes to confirm a vulnerability is really there, not just assume based on version.

    Haxolottle: Some tests can crash services though, so most scanners have a "safe mode" to avoid risky checks.

    ~ haxolottle_rapport += 5

+ [Why use automated scanning?]
    Haxolottle: Lots of reasons:

    Haxolottle: Speed - you can scan hundreds of systems in the time it takes to manually test one.

    Haxolottle: Coverage - they check for thousands of known vulnerabilities systematically.

    Haxolottle: Consistency - you can rescan regularly to catch new problems.

    Haxolottle: Less human error - you won't forget to check something obvious.

    Haxolottle: But they have big limitations too, which we'll get to.

    ~ haxolottle_rapport += 5

- -> vuln_scan_hub

=== scanning_vs_pentesting ===
Haxolottle: These are two different approaches to finding security holes, little axolotl.

~ haxolottle_rapport += 5

Haxolottle: Penetration testing is manual - you research, plan, and actually exploit vulnerabilities. Deeper, but slower.

Haxolottle: Vulnerability scanning is automated - faster and broader, but shallower.

+ [What's good about penetration testing?]
    Haxolottle: Penetration testing has some big advantages:

    Haxolottle: Very few false alarms - if you successfully exploit something, you know it's real.

    Haxolottle: Humans can chain vulnerabilities together in creative ways scanners can't imagine.

    Haxolottle: Human intuition spots logical flaws and business logic problems that scanners miss completely.

    Haxolottle: But there's always risk that an exploit might cause accidental damage.

    Haxolottle: And even skilled testers might miss obvious things when checking manually.

    ~ haxolottle_rapport += 5

+ [What's good about vulnerability scanning?]
    Haxolottle: Scanning is great for:

    Haxolottle: Speed - scan entire networks in hours instead of days or weeks.

    Haxolottle: Coverage - systematically check for thousands of known vulnerabilities.

    Haxolottle: Safety - you can avoid dangerous tests that might crash services.

    Haxolottle: Consistency - same tests every time, no variation.

    Haxolottle: Cost - after setup, scanning is cheap to repeat regularly.

    ~ haxolottle_rapport += 5

+ [Which is better?]
    Haxolottle: Use both, little axolotl!

    Haxolottle: Start with scanning to quickly find obvious issues.

    Haxolottle: Then use penetration testing to go deeper, verify findings, and chain vulnerabilities together.

    Haxolottle: Think of scanning as your smoke detector, penetration testing as your fire drill.

    Haxolottle: Most orgs do frequent scans with periodic penetration tests.

    ~ haxolottle_rapport += 5

- -> vuln_scan_hub

=== nmap_nse ===
Haxolottle: The Nmap Scripting Engine - NSE - is what makes Nmap really powerful, little axolotl.

~ haxolottle_rapport += 5

Haxolottle: NSE extends Nmap with scripts for service detection, vulnerability checking, even exploitation.

Haxolottle: Nmap comes with hundreds of scripts written in Lua.

+ [How do I use these scripts?]
    Haxolottle: Simplest way is the default script set:

    Haxolottle: nmap -sC TARGET

    Haxolottle: That runs all "default" scripts - safe, useful, not too intrusive.

    Haxolottle: For vulnerability scanning specifically: nmap --script vuln -sV TARGET

    Haxolottle: The vuln category has scripts that check for known vulnerabilities.

    Haxolottle: Or run specific scripts: nmap --script distcc-cve2004-2687 TARGET

    ~ haxolottle_rapport += 5

+ [Where are these scripts?]
    Haxolottle: All NSE scripts live in /usr/share/nmap/scripts/

    Haxolottle: List them: ls /usr/share/nmap/scripts/

    Haxolottle: Each script is a .nse file. Read the code to see what they check.

    Haxolottle: Like distcc-cve2004-2687.nse checks for that specific Distcc vulnerability.

    Haxolottle: Scripts are organized by category: auth, broadcast, default, discovery, dos, exploit, fuzzer, intrusive, malware, safe, version, and vuln.

    ~ haxolottle_rapport += 5

+ [How good is NSE for finding vulnerabilities?]
    Haxolottle: NSE is useful but limited, to be honest.

    Haxolottle: The vuln scripts check for specific, well-known vulnerabilities - not comprehensive like Nessus.

    Haxolottle: But they're great for quick checks and the Nmap community keeps them updated.

    Haxolottle: Think of NSE as a lightweight vuln scanner - good for initial assessment, but not a full replacement.

    ~ haxolottle_rapport += 5

- -> vuln_scan_hub

=== nessus_scanner ===
Haxolottle: Nessus is one of the big commercial vulnerability scanners, little axolotl.

~ haxolottle_rapport += 5

Haxolottle: It uses a web interface and can scan for tens of thousands of vulnerabilities.

Haxolottle: Tests are written in NASL - Nessus Attack Scripting Language - and get updated regularly.

+ [How do I use it?]
    Haxolottle: Access the web interface at https://localhost:8834

    Haxolottle: Login with the credentials you've been given (usually nessusadmin).

    Haxolottle: Click "New Scan" and pick a template - Basic Network Scan is a good start.

    Haxolottle: Enter your target IPs and click "Launch".

    Haxolottle: Nessus will systematically test everything and show results by severity: Critical, High, Medium, Low, Info.

    ~ haxolottle_rapport += 5

+ [What scan templates are there?]
    Haxolottle: Nessus has different scan profiles:

    Haxolottle: Basic Network Scan - general-purpose scan for network services.

    Haxolottle: Advanced Scan - lets you customize exactly what to check.

    Haxolottle: Web Application Tests - focused on web vulnerabilities.

    Haxolottle: Compliance scans - check against security policy standards.

    Haxolottle: Each template determines which checks run and how aggressive it gets.

    ~ haxolottle_rapport += 5

+ [How do I read the results?]
    Haxolottle: Nessus gives you detailed info for each finding:

    Haxolottle: Severity rating helps you prioritize - fix Critical and High first.

    Haxolottle: CVE identifiers link to official vulnerability databases.

    Haxolottle: Plugin descriptions explain what was found and why it matters.

    Haxolottle: Solution sections tell you how to fix it.

    Haxolottle: References link to more info and exploit code.

    Haxolottle: You can export as HTML, PDF, or XML - or import into Metasploit.

    ~ haxolottle_rapport += 5

+ [Basic vs Advanced scans?]
    Haxolottle: Basic scans use defaults - fast and safe.

    Haxolottle: Advanced scans let you customize everything:

    Haxolottle: Which checks to run, whether to do "thorough tests" (slower but deeper).

    Haxolottle: Whether to show potential false alarms.

    Haxolottle: Advanced scans find more but take longer and have slightly more risk of disruption.

    ~ haxolottle_rapport += 5

- -> vuln_scan_hub

=== nikto_scanner ===
Haxolottle: Nikto is a web vulnerability scanner - it only does web servers, but it does them well.

~ haxolottle_rapport += 5

Haxolottle: While Nmap and Nessus check web servers among other things, Nikto specializes in web-specific issues.

Haxolottle: It scans for over 6,000 web security problems - CGI scripts, misconfigurations, vulnerable software.

+ [How do I use it?]
    Haxolottle: Pretty straightforward:

    Haxolottle: nikto -host TARGET_IP

    Haxolottle: Nikto will auto-detect web servers on common ports and scan them.

    Haxolottle: Specific port: nikto -host TARGET_IP -port 8080

    Haxolottle: SSL/TLS sites: nikto -host TARGET_IP -ssl

    Haxolottle: Output shows each issue with references to more info.

    ~ haxolottle_rapport += 5

+ [What does Nikto find?]
    Haxolottle: Web-specific vulnerabilities:

    Haxolottle: Outdated server software with known exploits.

    Haxolottle: Dangerous default files and directories - admin panels, config files.

    Haxolottle: Server misconfigurations - directory listings, verbose errors.

    Haxolottle: Known vulnerable web apps and frameworks.

    Haxolottle: Interesting HTTP headers that reveal too much information.

    ~ haxolottle_rapport += 5

+ [Nikto vs Nessus for web scanning?]
    Haxolottle: They overlap but have different strengths:

    Haxolottle: Nikto is specialized - goes deeper on web-specific issues.

    Haxolottle: Nessus is broader - checks web servers plus everything else.

    Haxolottle: Nikto is free and open source. Nessus commercial versions are expensive.

    Haxolottle: For comprehensive web testing, use both! They find different things.

    ~ haxolottle_rapport += 5

- -> vuln_scan_hub

=== tool_limitations ===
Haxolottle: This is important, little axolotl - understanding what these tools CAN'T do.

~ haxolottle_rapport += 5

Haxolottle: No single tool finds everything. Different tools catch different vulnerabilities based on their databases and methods.

Haxolottle: All automated tools give you false positives and false negatives.

+ [What are false positives and negatives?]
    Haxolottle: False positives are vulnerabilities reported that don't actually exist.

    Haxolottle: Like a scanner thinks software is vulnerable based on version, but a patch was backported.

    Haxolottle: False negatives are real vulnerabilities the scanner completely misses.

    Haxolottle: Happens when vulnerabilities aren't in the database, or tests aren't configured right.

    Haxolottle: That's why you need manual penetration testing to confirm findings and find what was missed.

    ~ haxolottle_rapport += 5

+ [Why don't scanners find everything?]
    Haxolottle: Several reasons:

    Haxolottle: Signature-based detection only finds KNOWN vulnerabilities in their databases.

    Haxolottle: Zero-day vulnerabilities - unknown to vendors - won't be detected.

    Haxolottle: Configuration issues and logical flaws usually can't be detected automatically.

    Haxolottle: Scanners might miss services on non-standard ports.

    Haxolottle: Safe mode settings might skip tests that could confirm vulnerabilities.

    ~ haxolottle_rapport += 5

+ [Why do different scanners miss different things?]
    Haxolottle: Each scanner has different databases and methods:

    Haxolottle: Nmap NSE has limited vulnerability scripts, focused on network services.

    Haxolottle: Nessus has extensive checks but might miss web-specific issues.

    Haxolottle: Nikto specializes in web but doesn't check other services.

    Haxolottle: That's why pros run multiple scanners - each catches what others miss.

    Haxolottle: Even then, manual testing is essential to find what ALL the scanners missed!

    ~ haxolottle_rapport += 5

- -> vuln_scan_hub

=== commands_reference ===
Haxolottle: Here's your command reference, little axolotl.

~ haxolottle_rapport += 5

Haxolottle: **Nmap NSE Scanning:**

Haxolottle: Default script scan: nmap -sC TARGET

Haxolottle: Vulnerability scripts: nmap --script vuln -sV TARGET

Haxolottle: Specific ports: nmap --script vuln -sV -p 1-5000 TARGET

Haxolottle: Specific script: nmap --script distcc-cve2004-2687 TARGET

Haxolottle: List scripts: ls /usr/share/nmap/scripts/

Haxolottle: View script code: cat /usr/share/nmap/scripts/SCRIPT_NAME.nse

+ [Show me Nessus workflow]
    Haxolottle: **Nessus Scanning:**

    Haxolottle: Web interface: https://localhost:8834

    Haxolottle: Login: nessusadmin / nessusadmin01

    Haxolottle: **Workflow:**

    Haxolottle: 1. Click "New Scan"

    Haxolottle: 2. Pick template (Basic Network Scan or Advanced Scan)

    Haxolottle: 3. Enter scan name and target IPs

    Haxolottle: 4. For Advanced: enable Thorough tests, Show potential false alarms

    Haxolottle: 5. Click "Save" then "Launch"

    Haxolottle: 6. View results: Click scan → "Vulnerabilities" tab

    Haxolottle: 7. Export: "Export" → pick format (HTML, PDF, CSV, XML)

    ~ haxolottle_rapport += 3

+ [Show me Nikto commands]
    Haxolottle: **Nikto Web Scanning:**

    Haxolottle: Basic scan: nikto -host TARGET_IP

    Haxolottle: Specific port: nikto -host TARGET_IP -port 8080

    Haxolottle: SSL/HTTPS: nikto -host TARGET_IP -ssl

    Haxolottle: Multiple ports: nikto -host TARGET_IP -port 80,443,8080

    Haxolottle: **Tips:**

    Haxolottle: Output is verbose - redirect to file: nikto -host TARGET > nikto_results.txt

    Haxolottle: Specific paths: nikto -host TARGET -root /admin/

    ~ haxolottle_rapport += 3

+ [Show me the full workflow]
    Haxolottle: **Comprehensive Assessment:**

    Haxolottle: 1. Start with Nmap service detection: nmap -sV -p- TARGET

    Haxolottle: 2. Run Nmap vuln scripts: nmap --script vuln -sV TARGET

    Haxolottle: 3. Launch Nessus Basic scan for broad coverage

    Haxolottle: 4. Launch Nessus Advanced scan with thorough tests

    Haxolottle: 5. For web servers, run Nikto: nikto -host TARGET

    Haxolottle: 6. Compare results - note what each tool found uniquely

    Haxolottle: 7. Verify critical findings manually or with exploitation

    ~ haxolottle_rapport += 3

- -> vuln_scan_hub

-> END
