# Exploiting Vulnerabilities

### Automated vs Manual Vulnerability Scanning

A myriad of tools are available for vulnerability scanning - ranging from commercial (heavy costs) to open-source and free. Vulnerability scanners are a convenient means of canvassing an application for flaws.

Using a vulnerability scanner comes with various advantages and disadvantages:

| Advantages                                                                                        | Disadvantages                                                                              |
| ------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------ |
| Automated scans are easily repeated and results can be easily shared.                             | Can build reliance on these tools.                                                         |
| Scanners and quick and can test multiple apps efficiently.                                        | These are very loud and produce lots of traffic and logs, not good for avoiding detection. |
| Open-source versions exist.                                                                       | Open-source versions are often very basic and require expensive licenses to be useful.     |
| Automated scanners cover a wide range of vulnerabilities that can be hard to manually search for. | They often do not find every vulnerability available.                                      |

Manual scanning is often the way to go when testing an individual app or program. Ultimately, both techniques involve testing for vulnerabilities including:

| Vulnerability             | Description                                                                                                     |
| ------------------------- | --------------------------------------------------------------------------------------------------------------- |
| Security Misconfiguration | Due to developer oversight, for example, exposing server info in messages between the app and an attacker.      |
| Broken Access Control     | An attacker can access parts of an app they should not be able to.                                              |
| Insecure Deserialisation  | Insecure processing of data sent across an application, attacker may be able to pass malicious code to the app. |
| Injection                 | An attacker is able to input malicious data due to lack of input sanitisation.                                  |
