Vulnerability Discovery and Analysis
Vulnerability discovery and analysis
This domain converts scanner output into defensible findings. The exam tests tool selection, credentialed versus uncredentialed trade-offs, scoring, and the analysis step that separates a real vulnerability from a banner match.
Authenticated versus unauthenticated
Credentialed scans see installed patches, local configuration and software inventory; unauthenticated scans see only what the network exposes. Use least-privilege, read-only credentials, rotate them afterwards, and state in the report that the scan was credentialed - otherwise the remediation team inherits a false sense of coverage. Agent-based and passive monitoring fill gaps where active scanning is disruptive.
Scoring and prioritization
CVE identifies; CVSS v3.1 base metrics (AV, AC, PR, UI, S, C, I, A) plus temporal and environmental scores describe severity. Severity is not priority: weigh asset criticality, internet exposure, public exploit or Metasploit module availability, EPSS, compensating controls, and whether the vulnerable component is actually reachable. False positives waste remediation time; false negatives are worse.
Tooling by target
- Infrastructure: Nessus, OpenVAS/Greenbone, Qualys, Nmap vuln NSE scripts.
- Web applications: Burp Suite, OWASP ZAP, Nikto, SQLMap.
- Code and dependencies: SAST, software composition analysis, container image scanning.
- Fuzzing and reversing: AFL, boofuzz; strings, Ghidra, objdump, debuggers.
Worked example
A scanner flags CVE-2021-44228 (Log4Shell) on a Java application server. Verify the bundled log4j-core version first. Instead of a destructive payload, trigger a benign JNDI lookup to a DNS listener you control and watch for the callback, then weigh egress filtering and WAF coverage. If the JAR is patched and the plugin merely matched a file name, record a false positive with the version evidence and note the detection gap rather than closing the finding as clean. Where the lookup does call back, the finding is confirmed regardless of the printed version.
Traps
Pasting unscored scanner output into the report. Ranking a CVSS 10 above an exploitable medium on a domain controller. Never validating false positives or false negatives. Scanning cloud-hosted assets without the provider's authorization. Skipping credentialed scans because they need paperwork.