Vulnerability Identification and Verification
This domain tests scan operation, triage, and proof that a reported vulnerability is real and relevant.
Scanning and scoring
Use authenticated scans where possible; they find more and produce fewer false positives. Understand CVSS v3.1 base metrics and vectors, plus temporal and environmental scores. EPSS estimates exploitation likelihood, and the CISA KEV catalog identifies known exploited vulnerabilities. CVE identifies the flaw; CWE describes the weakness class.
Verification
Do not report raw plugin output. Confirm the vulnerable version or configuration, then use a safe proof-of-concept that does not damage data. For blind vulnerabilities, use an out-of-band interaction server. Assess exposure: internet-facing, authenticated, or segmented. Record compensating controls such as a WAF or network ACL, but do not let them erase the underlying finding.
Worked example
A scanner flags CVE-2021-44228 (Log4Shell) on an application server. The reasoning: the plugin may match a library path without proving exploitability. Check the installed library version and the application's logging path, then use a controlled OAST callback with a unique identifier. If the callback arrives, the finding is confirmed; if not, downgrade to a version-review finding and state the limitation.
Traps
Ranking solely by CVSS. Reporting unverified scanner output. Using stale scan credentials that silently reduce coverage. Testing destructive payloads in production. Ignoring asset criticality and network exposure.