RDP:
Vulnerability Discovery
Detect BlueKeep, DejaBlue, and missing NLA on RDP hosts
RDP Known Vulnerability Detection
Identifies known RDP vulnerabilities including BlueKeep, DejaBlue, and misconfigurations using Nmap scripts, Metasploit modules, and manual version checks.
RDP NLA Not Enforced
Identifies RDP servers lacking Network Level Authentication, enabling pre-authentication attacks and brute force without valid credentials.
RDP vulnerability discovery checks for configuration weaknesses and known CVEs that expose the service. Start with NLA: when disabled, the server presents a full login screen to unauthenticated users, enabling brute-force attacks and information disclosure. rdp-sec-check and Nmap scripts detect this quickly.
BlueKeep (CVE-2019-0708) affects Windows 7, Server 2008, and Server 2008 R2 with RDP enabled. Scan for it using Metasploit's auxiliary/scanner/rdp/cve_2019_0708_bluekeep or rdpscan. Unpatched systems are increasingly rare on the internet but still appear in internal networks and legacy environments.
Weak encryption (Standard RDP Security without NLA) allows man-in-the-middle attacks. SMB signing and RDP security settings often correlate, so weak RDP configuration hints at broader issues. Check for exposed RDP without MFA, since RDP with only password authentication on internet-facing hosts is a critical finding regardless of patch level.