Anyone have any good external pen testing tools that you’ve used on your self hosted setup? Mine is pretty secure overall but I would like to be able to scan the WAN for vulnerabilities or misconfigurations just to make sure I haven’t missed anything.
Probably anything within the Kali Linux suite or any security-centric distribution. If possible, boot it up to a laptop hooked to a phone hotspot or any network outside your home network, route through a VPN, determine your WAN IP, and go to town.
Plus 1 to openvas. UI is indeed horrendous though.
Be careful running high load tests against sensitive devices. I once ran it against a PoE switch I used for my cameras and it did something so crazy that it required me not to only power cycle the switch, but to disconnect all the cameras first and then power cycle. Was super confusing and felt like it found a way to short the device lol. Scared the hell out of me.
That being said, I’ve found many many things to improve on my devices thanks to openvas.
I had a colleague at work years ago who did his Master’s thesis on network scanning. He ran a PoC in the company’s network and had all the printers print hundreds of pages.
We learned that printers suck and that we should always know our payloads and targets 😁
Not sure if there’s a free tier. Lifetime memberships go on sale for cheap at least once a year, though.
Personally I’d run a free VM in the cloud and scan yourself with nessus, nmap, and such. Trying to scan yourself from inside doesn’t really work well for some reason. I assume it’s something to do with routing.
You can try to scan your server with vulnerability assessment tools such as Nessus (it is available as a docker container) or sn1per which is open source.
It’s more a EULA than an actual license. It prohibits a lot of stuff, and is basically source-available.
You agree not to create any product or service from any par of the Code from this Project, paid or free
There is also:
Sn1perSecurity LLC reserves the right to change the licensing terms at any time, without advance notice. Sn1perSecurity LLC reserves the right to terminate your license at any time.
So yeah. I decided to test it out anyways… but what I see… is not promising.
FROM docker.io/blackarchlinux/blackarch:latest
# Upgrade system
RUN pacman -Syu --noconfirm
# Install sn1per from official repository
RUN pacman -Sy sn1per --noconfirm
CMD ["sn1per"]
The two pacman commands are redundant. You only need to run pacman -Syu sn1per --noconfirm once. This also goes against docker best practice, as it creates two layers where only one would be necessary. In addition to that, best practice also includes deleting cache files, which isn’t done here. The final docker image is probably significantly larger than it needs to be.
Their kali image has similar issues:
RUN set -x \
&& apt -yqq update \
&& apt -yqq full-upgrade \
&& apt clean
RUN apt install --yes metasploit-framework
It’s still building right now. I might edit this post with more info if it’s worth it. I really just want a command-line vulnerability scanner, and sn1per seems to offer that with greenbone/openvas as a backend.
I could modify the dockerfiles with something better, but I don’t know if I’m legally allowed to do so outside of their repo, and I don’t feel comfortable contributing to a repo that’s not FOSS.
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !selfhosted@lemmy.world
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don’t control.
Rules:
Be civil: we’re here to support and learn from one another. Insults won’t be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it’s not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don’t duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
No trolling.
Resources:
selfh.st Newsletter and index of selfhosted software and apps
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:
3 acronyms in this thread; the most compressed thread commented on today has 4 acronyms.
[Thread #694 for this sub, first seen 21st Apr 2024, 07:15] [FAQ] [Full list] [Contact] [Source code]
I’d like to know the answer here as well
Probably anything within the Kali Linux suite or any security-centric distribution. If possible, boot it up to a laptop hooked to a phone hotspot or any network outside your home network, route through a VPN, determine your WAN IP, and go to town.
I’m a big fan of hashcat for this use case myself! I route it through WS, however. I like being on the bleeding edge.
Check out openvas.
https://github.com/greenbone/openvas-scanner
I use Nessus professionally, they are somewhat similar. I can’t decide which one has the worse user interface.
Plus 1 to openvas. UI is indeed horrendous though.
Be careful running high load tests against sensitive devices. I once ran it against a PoE switch I used for my cameras and it did something so crazy that it required me not to only power cycle the switch, but to disconnect all the cameras first and then power cycle. Was super confusing and felt like it found a way to short the device lol. Scared the hell out of me.
That being said, I’ve found many many things to improve on my devices thanks to openvas.
I had a colleague at work years ago who did his Master’s thesis on network scanning. He ran a PoC in the company’s network and had all the printers print hundreds of pages.
We learned that printers suck and that we should always know our payloads and targets 😁
Another +1 to openvas. Specifically, I have had much luck with this Dockerized version: https://github.com/immauss/openvas
https://monitor.shodan.io/
Not sure if there’s a free tier. Lifetime memberships go on sale for cheap at least once a year, though.
Personally I’d run a free VM in the cloud and scan yourself with nessus, nmap, and such. Trying to scan yourself from inside doesn’t really work well for some reason. I assume it’s something to do with routing.
You can try to scan your server with vulnerability assessment tools such as Nessus (it is available as a docker container) or sn1per which is open source.
sn1per is not open source, according to the OSI’s definition
The license for sn1per can be found here: https://github.com/1N3/Sn1per/blob/master/LICENSE.md
It’s more a EULA than an actual license. It prohibits a lot of stuff, and is basically
source-available.There is also:
So yeah. I decided to test it out anyways… but what I see… is not promising.
The two
pacmancommands are redundant. You only need to runpacman -Syu sn1per --noconfirmonce. This also goes against docker best practice, as it creates two layers where only one would be necessary. In addition to that, best practice also includes deleting cache files, which isn’t done here. The final docker image is probably significantly larger than it needs to be.Their kali image has similar issues:
https://www.docker.com/blog/intro-guide-to-dockerfile-best-practices/
It’s still building right now. I might edit this post with more info if it’s worth it. I really just want a command-line vulnerability scanner, and sn1per seems to offer that with greenbone/openvas as a backend.
I could modify the dockerfiles with something better, but I don’t know if I’m legally allowed to do so outside of their repo, and I don’t feel comfortable contributing to a repo that’s not FOSS.