3.2.3. Multipurpose and Cloud Assessment Tools

💡 First Principle: Cloud environments require cloud-native assessment tools because traditional network scanners can't evaluate cloud-specific misconfigurations — IAM policy over-permissiveness, S3 bucket exposure, or insecure serverless function permissions are invisible to a port scanner.

Multipurpose Tools:

Nmap — The foundational network scanner. Beyond port scanning, Nmap's NSE (Nmap Scripting Engine) enables vulnerability detection, service version enumeration, and custom checks. Syntax fundamentals:

• -sS — SYN scan (stealth)
• -sV — Service/version detection
• -O — OS detection
• -A — Aggressive scan (OS + version + scripts + traceroute)
• -p 1-1024 — Specific port range
• -sU — UDP scan (finds services like DNS/53, SNMP/161, and DHCP/67 that a TCP-only scan misses)
• -T0–-T5 — Timing template (speed vs. stealth). Use a slow -T1/-T2 on fragile OT/ICS or IDS-monitored networks to avoid disruption or detection; -T4 is common for fast internal scans

⚠️ Exam Trap: Default TCP scans (-sS/-sV) never reveal UDP-only services — a missing -sU leaves DNS, SNMP, and DHCP exposures undetected. And on sensitive OT/SCADA networks, an aggressive scan (-A, high -T) can crash fragile devices; dial the timing down.

Metasploit Framework — The industry-standard penetration testing and exploit development platform. From a vulnerability assessment perspective: Metasploit validates whether a vulnerability is actually exploitable (not just theoretically present). An analyst can test whether a Nessus-flagged vuln can actually be exploited — confirming true positives and eliminating false positives. Exploitation is not passive: a module can crash a service, corrupt data or leave a foothold behind, so run it only within written authorization and scope and under change control, preferably against a test copy. Unauthorized use against production is both a disruption risk and a legal one.

Recon-ng — A web reconnaissance framework for OSINT gathering. Modules for gathering domain information, email addresses, social media profiles, and infrastructure data — useful for external attack surface assessment.

Angry IP Scanner — Lightweight, cross-platform network scanner for quick host discovery and port scanning. Less powerful than Nmap but simpler for basic asset discovery.

Maltego — Visual link analysis tool for mapping relationships between entities (domains, IPs, email addresses, organizations). Used in threat intelligence and external attack surface mapping.

Wireshark — Packet capture and protocol analyzer: records and decodes the traffic that actually crosses a network, so you can see cleartext credentials, scan traffic and protocol anomalies. It observes and analyzes; unlike Nessus, Nmap or Burp Suite it does not scan or probe targets.

Cloud Infrastructure Assessment Tools:

The cloud assessment workflow mirrors traditional vulnerability scanning: Scout Suite/Prowler find misconfigurations → validate severity → prioritize by exploitability and asset criticality → remediate.

⚠️ Exam Trap: Cloud misconfigurations are typically more severe than traditional unpatched software vulnerabilities — a publicly accessible S3 bucket containing customer data is immediately exploitable with no technical skill. Cloud assessments should be a routine part of any vulnerability management program, not an occasional one-off.

Network Scanning and Mapping: Angry IP Scanner and Masscan

A common workflow chains them: Masscan (or Angry IP Scanner) narrows a huge range to live hosts and open ports, Nmap identifies what is listening, and a vulnerability scanner decides whether it is vulnerable.

⚠️ Exam Trap: An open port from Masscan is a discovery result, not a vulnerability. Masscan can optionally grab banners, but a banner is still not proof of a flaw. When scanning broad ranges, exclude addresses you are not authorized to scan (--excludefile).

Cloud Assessment Tools — Code and Artifacts, Not Just Accounts:

ScoutSuite and Prowler audit cloud accounts that already exist, gathering configuration through the provider's APIs. Two further CySA+ tools shift the check earlier, into the build pipeline:

Note: Prowler began as an AWS tool, and older material still describes it that way; it now covers multiple clouds and SaaS platforms.

⚠️ Exam Trap: Match the tool to where the problem lives. A vulnerable library in a container image → Trivy. A public storage bucket defined in a Terraform file that has not been applied → Checkov. A bucket that is already public in production → ScoutSuite or Prowler.

Breach and Attack Simulation (BAS) Tools:

A vulnerability scanner asks "what weaknesses exist?" Breach and attack simulation asks "if an attacker used this technique here, would our controls stop or detect it?" BAS tools execute known adversary techniques in a controlled, repeatable way and map the results to MITRE ATT&CK, so detection coverage can be re-measured after every rule or tool change.

⚠️ Exam Trap: BAS does not replace a penetration test. A pentest is a human-led, point-in-time engagement that finds creative attack paths; BAS repeatedly checks that controls still detect known techniques. Run BAS on test or approved endpoints — the techniques are real.

Reflection Question: A cloud security assessment using Scout Suite identifies 847 findings across an AWS environment. The most critical: three S3 buckets with public read access, an IAM user with administrator privileges and no MFA, and 15 EC2 security groups allowing unrestricted inbound SSH (0.0.0.0/0). Using the principle that attackers prioritize the easiest path to the most valuable target, in what order would you prioritize these three findings and why?