I am currently studying how to do server pentesting and need some advice/protip related to methology/best practices.
People often mention that it is a good idea to gather intelligence and enumerate all vulnerabilities you are going to verify before moving to exploitation.
I've already done some recon/banner grabbing for the services running on the server, and thinking about building list of vulnerabilities so I cold have some kind of checklist containing vulnerabilities I should try to exploit.
My idea at the moment is to manage this:
- by running vulnerability scanners like openvas and nexpose
- by doing manual search using services that runs on server in public databases like exploit-db.com and 1337day.com
[1] should give me CVE numbers/other references regarding to the ways I can exploit found vulnerabilities manually. I also should be able to import reports them into metasploit and use metasploit for their exploitation later.
[2] seems to be more effort taking point since I'll have to check multiple databases and grab all they have for all the services I've discovered and then merge this list with vulnerabilities discovered using [1]
After that I am going to try to exploit everything I've found.
So, my questions are: Is the described scenario is a good idea? Maybe I am missing something and there is something I should change in my plan? Maybe there are any other tips you can give me (I am especially interested in ways to ease [2] as much as possible)?