Automation of active reconnaissance phase: an automated API-based port and vulnerability scanner

Abstract

The unprecedented growth in technology has increased the importance of the required information security that is still hard to be reached. Recently, network and web application attacks have occurred frequently, causing confidential data to be stolen by the available vulnerabilities in the systems and the most prominent is in the form of open ports. This causes the CIA (Confidentiality Integrity and Availability) Triad Model to break. Penetration testing is one of the key techniques used in real life to accurately detect the possible threats and potential attacks against the system, and the first step for hackers to conduct attacks is information collection. In this paper, we present a useful schema for the active information-gathering phase that can be used during penetration testing and by system administrators. It will be the first feature of a security engine going to be implemented. The work involves an automated API-based IP and port scanner, service-version enumerator, and vulnerability detection system. This scheme is based on the Network Mapper (Nmap) to collect the information with high accuracy depending on the provided rules in our schema. Besides, the work has been implemented as a RESTful-API server, aiming at easy integration for real-life cases and allowing administrators to scan and secure their networks more quickly and easily. The effectiveness and efficiency of this technique has been proved by the various test cases applied considering different scenarios from the real world. The average time of scanning a server and detecting the vulnerabilities is 2.2 minutes. Regardless of the number of vulnerabilities, the increase in time for each open port is just about 12 seconds.