Matching services with public vulnerability advisories and picking the low-hanging fruit

Version discovery is essential to penetration testers and system administrators as they can use version banners to find public security vulnerabilities affecting a service. NSE allows us to match popular vulnerability databases with the versions of services obtained from our scan automatically.

This recipe shows how to list public security advisories that could possibly affect a service discovered with Nmap.

How to do it...

1. To match security advisories with the service versions obtained from the version detection engine, use the following command:

   # nmap -sV --script vulners <target>

2. The NSE vulners script will return all security advisories that match the service version in the existing database from https://vulners.com:

   Nmap scan report for scanme.nmap.org (45.33.32.156)
   Host is up (0.090s latency).
   Other addresses for scanme.nmap.org (not scanned): 2600:3c01::f03c:91ff...