It is the end of week 2 of my Offsec101 course, and I am still learning a ton. I went ahead and sent in for my demo of SaintExploit, which is one of the perks you get for taking the course. I will review the other when I receive it.
My first thoughts, before using Saint Exploit was that it was a huge package, and had a lot of overhead. I generally dislike web interfaced programs that have nothing to do with configuration,management, or manipulation of web applications, however this was an exception.
I have a limited address limit, (10 ip addresses), so I compiled a list of a few questionable work computers, and my home addresses. I am at work now, and had m EEE with me, so I booted it up and ran saint exploit, and added my generated key to the application.
Next I selected which hosts from the key file I wanted to perform penetration tests on. After that it is all about watching and waiting, while it automates the penetration testing life-cycle on each host.
At the end of the testing, it presents, in detailed format, the results, and their impact, as well as exploits that succeeded and their CVE’s.
Testing by hand, I could not penetrate one of the PC’s yesterday, however Saint Exploit done so, surprisingly by weak password and an exploit. The exploit used was one I thought the system was vulnerable to, but could not get metasploit or any exploit code to execute correctly on it. This, my friends, is the difference between open exploit code and commercial grade exploit code.
I do not think I will be getting a license for Saint Exploit, because I’m broke would be the first reason, however I would recommend it in a heartbeat to any serious penetration tester or auditor who could afford a license.
Addendum:
I didn’t realize how much it sounded like I was bashing the metasploit team. I don’t proofread my articles, as I’m sure anyone whos read any of my posts can tell haha.
Turns out, it was not the metasploit module that was giving me problems, it was my own brain. The module I was working with, that I had suspected the server vulnerable to was the msdns_zonename exploit. After some enumeration, I attempted the metasploit exploit on different ports that I was suspect to, and it never succeeded.
Had I just stfu and let metasploit do what it does and run an automatic check 
, then I would have seen that it enumerated a port I did not find in my scans, and successfully exploited it. I learned a pretty valuable lesson in not trusting myself, and port scanning beyond the basic common ports, as I believe the vulnerable DNS RPC service is randomly binded to a high port, above 1024 or something like that.
Nevertheless, I think Saint Exploit and other such tools, like CI, and scanners like Nessus, serve their purpose, but should not be relied on. My thinking, is that if you can afford a SE/CI license, that maybe doing a starting/finishing scan with these products, along with a manual testing, would make sure no stones are left unturned.
but I’ll let you find that.
