Vulnerability Discovery

WinRM vulnerability discovery checks whether the service is configured securely or if it exposes attack surface. The first thing to verify is transport security: WinRM over HTTP (port 5985) transmits credentials in cleartext when Basic authentication is enabled, making it trivially interceptable on the network.

Check for missing authentication requirements, overly permissive TrustedHosts settings (especially wildcard entries that allow any client to connect), and endpoints accessible to low-privilege users who should not have remote management access. WinRM configured to allow unencrypted traffic or Basic auth over HTTP is a finding on its own.

The subpages cover specific checks for transport security, authentication configuration, access control on WinRM endpoints, and how to identify JEA configurations that are too permissive or contain escape paths from their intended restrictions.