Hack Like a Pro: How to Find the Latest Exploits and Vulnerabilities—Directly from Microsoft « Null Byte :: WonderHowTo

Welcome back, my rookie hackers!Several of you have written me asking about where they can find the latest hacks, exploits, and vulnerabilities. In response, I offer you this first in a series of tutorials on finding hacks, exploits, and vulnerabilities. First up: Microsoft Security Bulletins.Step 1: Navigate to Microsoft's TechnetAs well over 90% of all computers on the planet run a version Microsoft's ubiquitous Windows operating system (although it might surprise you that over 60% of all web servers run some version of Linux/Unix), Microsoft's vulnerabilities obviously are highly valued to the hacker.Thankfully, Microsoft offers us database of all the vulnerabilities they want to acknowledge, and this can be found at theirMicrosoft Security Bulletinswebpage.Here, Microsoft lays out all the details of the vulnerabilities that they are aware of in their operating system and application software. It goes without saying—I think—that zero day vulnerabilities and vulnerabilities that Microsoft doesn't want to acknowledge yet, won't be found here. These vulnerabilities are only those that Microsoft is aware of and has a patch developed for.So, what good is it to the hacker to be aware of vulnerabilities that Microsoft has patched, you might ask (you did ask that, right?). The answer is that not everyone patches.Some users and companies refuse to patch because of the production risks involved and others only patch intermittently. If you check outNetcraftand look up a particular website, it will tell you how long since that website has been re-booted. Generally, a re-boot is necessary to patch a system. If the system has not been re-booted for, say 2 years, we know that all the vulnerabilities listed in Microsoft's security bulletin are available on that system. When that's the case, you can simply find a vulnerability that has been found within that last two years and then exploit it on that system.There is also the issue of pirated software. A significant fraction of the world's operating systems and applications are pirated (I'm sure you know at least one person was has pirated software, right?). It is estimated that a majority of the software in China and other developing nations is pirated. This means that these systems will NOT get the latest patches and are vulnerable to the listed vulnerabilities in Microsoft's security bulletins. How nice!Step 2: Search the Database by Microsoft Vulnerability NumberThe Microsoft security bulletins are an easily searched database. You can search it by product, date range or security bulletin number. If you go back and look atsome of my Metasploit tutorials, you will notice that I've used an exploit in Metasploitmany,manytimesthat's named ms08_067_netapi. That number is the Microsoft security bulletin number. Themsstands for Microsoft, of course, the08stands for the year the vulnerability was unveiled, 2008, and the 067 means it was 67th vulnerability acknowledged by Microsoft that year. If we search Microsoft's security bulletins for that vulnerability, this is what we find.Notice that this vulnerability is named "Vulnerability in Server Service Could allow Remote Code Execution". Remote code execution is exactly what we are looking for. It allows listeners/rootkits to be installed and executed remotely. This obviously includes our rootkit of choice, Metasploit's meterpreter. When we click on it, we get the complete report.We can see that Microsoft provides us (thank you, Bill!) will an executive summary of the exploit and tells which of their systems are vulnerable. If we page down we can see a list of all affected files and operating systems.Step 3: Search Vulnerabilities by ProductIf we are looking for vulnerabilities in a particular product, we can use this database and search by product. For instance, if I was looking for a vulnerability in Microsoft's Lync (this is Microsoft's enterprise-level instant messaging, VOIP, and video conferencing server with special security features), I can simply select Lync and this database will show me all the vulnerabilities of that product. Here's the most recent vulnerability found in Microsoft's Lync product that "allows for remote code execution" Yeah!We'll be checking out some of the other resources for finding vulnerabilities, hacks and exploits in future tutorials, so stay tuned.Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseRelatedHack Like a Pro:How to Exploit and Gain Remote Access to PCs Running Windows XPHack Like a Pro:How to Find Almost Every Known Vulnerability & Exploit Out ThereHack Like a Pro:How to Exploit Adobe Flash with a Corrupted Movie File to Hack Windows 7Hack Like a Pro:How to Hack Windows Vista, 7, & 8 with the New Media Center ExploitHack Like a Pro:How to Exploit IE8 to Get Root Access When People Visit Your WebsiteHow To:Top 10 Exploit Databases for Finding VulnerabilitiesHack Like a Pro:Hacking Windows XP Through Windows 8 Using Adobe Flash PlayerHow To:Hack Lets You Fully Activate a Bootleg Copy of Windows 8 Pro for FreeHow to Hack Like a Pro:Getting Started with MetasploitHack Like a Pro:How to Use Hacking Team's Adobe Flash ExploitHack Like a Pro:How to Find  Exploits Using the Exploit Database in KaliHow to Hack Like a Pro:Hacking Windows Vista by Exploiting SMB2 VulnerabilitiesHack Like a Pro:Using Nexpose to Scan for Network & System VulnerabilitiesHack Like a Pro:How to Scan the Internet for Heartbleed VulnerabilitiesNews:How to Study for the White Hat Hacker Associate Certification (CWA)News:Hack the Switch? Nintendo's Ready to Reward You Up to $20,000Hack Like a Pro:Using the Nmap Scripting Engine (NSE) for ReconnaissanceHack Like a Pro:How to Hack the Shellshock VulnerabilityNews:WannaCry Ransomware Only Works if You Haven't Updated Your Computer in MonthsHack Like a Pro:How to Hack Web Apps, Part 5 (Finding Vulnerable WordPress Websites)News:'Metaphor' Exploit Threatens Millions of Android Devices—Here's How to Stay SafeHow To:Use NMAP 7 to Discover Vulnerabilities, Launch DoS Attacks and More!How to Hack Windows 7:Sending Vulnerable Shortcut FilesHack Like a Pro:How to Spy on Anyone, Part 1 (Hacking Computers)How To:Scan for Vulnerabilities on Any Website Using NiktoHow to Hack Databases:Hunting for Microsoft's SQL ServerNews:Flaw in Facebook & Google Allows Phishing, Spam & MoreHack Like a Pro:Hacking Samba on Ubuntu and Installing the MeterpreterHow To:Spider Web Pages with Nmap for SQLi VulnerabilitiesHow To:Mac OS X Hit Again! How to Find and Delete the New SabPub MalwareEasily Access MS Tutorials:Microsoft's Desktop PlayerWeekend Homework:How to Become a Null Byte ContributorIPsec Tools of the Trade:Don't Bring a Knife to a GunfightGoodnight Byte:HackThisSite, Realistic 3 - Real Hacking SimulationsHow To:Is Your Website Vulnerable to XSS Injections? Here's How to Protect Your VisitorsRoot Exploit:Memodipper Gets You Root Access to Systems Running Linux Kernel 2.6.39+