Vulnerability Scanning and Analysis
What to know
Vulnerability scanning automates matching a fingerprint (banner, version string, patch level, plugin output) against a database of known issues. Typical tools are Nessus or OpenVAS for infrastructure, Nikto for web sanity checks, nmap --script vuln for quick wins, and searchsploit to locate public exploit code. The tested skill is triage, not launching a scanner: deciding which findings are real, reachable, and exploitable on this specific target.
Distinguish severity from risk. A CVSS base score ignores whether the service is exposed, whether authentication is required, and whether a working exploit exists. A 9.8 in an unreachable internal component matters less than a 6.5 with a public exploit on a listening port. Note also whether a scan was credentialed; unauthenticated scans see banners, credentialed scans see actual patch levels and installed packages.
Traps
- Presenting scanner output as a confirmed vulnerability; questions frequently hinge on manual verification.
- Banner mismatch: distributions backport patches, so a banner can understate or overstate the true version.
- Exploiting a flagged issue that depends on configuration you never checked.
- Chasing CVEs when the intended path is plain misconfiguration: default credentials, anonymous access, exposed
.git, directory listing, verbose errors.
Worked example
A scan reports an Apache version with a known path-traversal flaw. Instead of firing an exploit blindly, send one crafted request, confirm the response leaks a file you can name, then move to code execution. That single verification step converts a “possible” into a confirmed finding you can defend in a report.