Vulnerability Assessment

Skill: Vulnerability Assessment

Supplementary Files:

• payloads.md — Vulnerability assessment command collection covering automated scanning, NSE scripts, web scanning, CVE analysis, compliance checks, and report generation
• test-cases.md — Structured test case list covering network scanning, web application scanning, CVE analysis, compliance checks, and report generation scenarios

Summary

Vulnerability Assessment skill domain covering assessment operations.

Tools: OpenVAS / GVM, Nessus, Nikto, Nmap (vuln), Lynis, Nuclei, OpenVAS/GVM, Nmap vuln

Domain: assessment

Description

Vulnerability assessment is the process of systematically identifying and quantifying security weaknesses in information systems through automated scanning, CVE analysis, and risk scoring. Unlike penetration testing, which focuses on vulnerability exploitation, vulnerability assessment focuses on discovery, classification, and prioritization, covering the complete vulnerability management lifecycle from asset discovery to remediation tracking.

Core competencies include: selecting and configuring scanning tools appropriate for the target environment, interpreting scan results and eliminating false positives, using the CVSS scoring system to assess risk levels, writing actionable vulnerability reports, and developing patch management and compensating control strategies.

Use Cases

1. Compliance Auditing - Meeting periodic vulnerability scanning requirements in security standards such as PCI DSS, ISO 27001, and MLPS (Multi-Level Protection Scheme)
2. Security Baseline Assessment - Comprehensive security checks for newly deployed systems or assets after major changes
3. Patch Prioritization - Determining patch deployment order based on CVSS scores and asset value
4. Continuous Vulnerability Management - Establishing periodic scanning mechanisms to monitor attack surface trends
5. Pre-Penetration Testing Reconnaissance - Providing a full vulnerability landscape of the target to narrow attack attempt scope

Core Tools

Supporting tools: searchsploit (local Exploit-DB search), cvss (CVSS vector calculator), vulners.nse (Nmap online vulnerability correlation), Trivy (container image vulnerability scanning).

Methodology

Attack Chain

Asset Discovery        Automated Scanning     Manual Verification    Risk Assessment
(Network recon,      (OpenVAS,             (False positive        (CVSS scoring,
 nmap -sn)             Nuclei,               elimination,           asset value,
                       nikto)                exploitation           business impact)
                                             verification)
    |                 |                  |                  |
    v                 v                  v                  v
Remediation           Rescan              Report              Continuous
Tracking              Verification        Archiving           Monitoring
(Patch deployment,  (Rescan,            (Knowledge base     (Periodic scans,
 compensating         regression           updates,           change-triggered
 controls)            testing)             trend analysis)    scanning)

Phase Details:

1. Asset Discovery - Enumerate all live hosts, open ports, and running services within the target scope, building a complete asset inventory
2. Automated Scanning - Select appropriate tools for batch vulnerability detection based on asset types, covering known CVEs, configuration flaws, and weak passwords
3. Manual Verification - Eliminate false positives from automated tools, confirm actual exploitability of vulnerabilities, and assess real-world impact
4. Risk Assessment - Determine vulnerability priority by combining CVSS scores, asset value, and business context
5. Remediation Tracking - Track vulnerability remediation progress, deploy compensating controls for vulnerabilities that cannot be immediately fixed
6. Rescan Verification - Re-scan after remediation to confirm vulnerabilities have been eliminated and prevent regression

Defense Perspective

• Patch Management - Establish tiered patch processes: Critical/High vulnerabilities fixed within 72 hours, Medium within 30 days
• Vulnerability Scanning Schedule - Weekly scans for critical assets, monthly for general assets, immediate scans after major changes
• CVSS Prioritization - CVSS >= 9.0 handled immediately, 7.0-8.9 within one week, 4.0-6.9 monthly, < 4.0 quarterly assessment
• Compensating Controls - Deploy WAF rules, network isolation, and access restrictions as temporary mitigations for unpatchable vulnerabilities
• Attack Surface Reduction - Continuously reduce exposure: disable redundant services, restrict admin port access, harden default configurations

Practical Steps

1. Nmap Vulnerability Scanning

Use NSE scripts to detect known CVEs, SSL/TLS configuration flaws, and SMB-related vulnerabilities in target services.

2. Nikto Web Assessment

Web server vulnerability scanning to detect outdated software, dangerous files, misconfigurations, and other security issues.

3. Nuclei Template Scanning

Template-based rapid vulnerability detection supporting CVE templates, custom templates, and batch scanning.

4. CVSS Scoring Methodology

Use the CVSS v3.1 scoring system to grade vulnerabilities and determine remediation priority.

5. Vulnerability Report Writing

Write vulnerability assessment reports following a standard structure, including executive summary, vulnerability details, and risk trend analysis.

Detailed payloads in payloads.md, complete test checklist in test-cases.md.

Detection Methods

Vulnerability Scan Detection

• Scan signatures: Nessus, Qualys, OpenVAS fingerprints in network traffic.
• Heavy load on target: Rapid connection rate; service-specific probes.
• UA patterns: Scanner-specific User-Agent strings (Nessus, OpenVAS).

SIEM Detection Rules

• Splunk SPL: index=vuln sourcetype=nessus | stats count by host | where cvss > 7
• VM platform: Tenable, Qualys, Rapid7; native scan logging.

Defense Evasion Techniques

Stealth Scanning

• Slow scan: Pace below 1 packet/sec; below rate-based detection.
• Distribute sources: Spread scan across many source IPs.
• Use sanctioned tools: Use authorized VM scanner; appears as legitimate activity.
• Avoid scanner-specific UAs: Strip or randomize User-Agent.

Common Pitfalls

• Treating scanner output as ground truth: Automated scanners produce both false positives and false negatives. A "Critical" finding may be mitigated by environment-specific factors, while a "Low" finding may be exploitable in the specific target context. Every finding must be manually verified before reporting.
• Scanning without proper asset inventory: Starting a vulnerability scan without first establishing a complete asset inventory leads to incomplete coverage. Unknown hosts, shadow IT systems, and forgotten subdomains will not be scanned, creating blind spots that attackers will find.
• Ignoring scan timing and network impact: Aggressive scanning against production systems can cause service degradation, device reboots (especially for legacy IoT/SCADA systems), or trigger IPS blocking that masks results. Always calibrate scan intensity based on the target environment's sensitivity.

Automation and Scripting

Automate vulnerability management workflows by scheduling OpenVAS scans via its GMP (Greenbone Management Protocol) API, parsing results with custom Python scripts, and auto-generating ticket entries in tracking systems for verified findings. Use Nuclei with custom templates in CI/CD pipelines to scan new deployments before they reach production. Script cross-referencing between scanner outputs (OpenVAS + Nuclei + Nmap vuln scripts) to automatically identify findings confirmed by multiple tools, which have higher confidence and should be prioritized for remediation.

Reporting and Documentation

Vulnerability assessment reports should follow a standard structure: executive summary with risk trend charts, detailed findings with CVSS scores and proof-of-concept evidence, remediation recommendations with specific vendor patches or configuration changes, and a rescan verification section confirming closure. Include false positive analysis documentation showing which findings were verified versus discounted. Use consistent severity ratings (Critical/High/Medium/Low/Info) mapped to CVSS ranges and include trend analysis comparing results to previous assessment periods to track security posture improvement or degradation.

Legal and Ethical Considerations

Vulnerability scanning, even without exploitation, can disrupt systems and is subject to legal restrictions in most jurisdictions. Obtain explicit written authorization specifying the target IP ranges, scan types permitted (authenticated vs. unauthenticated, intrusive vs. non-intrusive), and testing windows. Some compliance frameworks (PCI DSS) require specific scanning cadences and approved scanning vendors (ASV). Never scan systems outside the authorized scope, even if they are discovered during the assessment as adjacent hosts. Report any accidentally discovered critical vulnerabilities on out-of-scope systems through responsible disclosure channels.

Integration with Other Tools

Vulnerability assessment serves as the reconnaissance foundation for penetration testing and security operations. Scanner outputs feed into network-pentest for targeted exploitation of verified vulnerabilities. CVE findings from Nuclei and OpenVAS connect to binary-reverse for deep analysis of vulnerable software components. Container image vulnerability results integrate with container-security for runtime risk assessment. Use the SecLists repository for standardized dictionaries and payloads across all scanning tools, and feed results into the chronicle skill for longitudinal knowledge tracking.

Case Studies and Examples

• Unpatched VPN gateway: An OpenVAS scan of an external network segment identified a Pulse Secure VPN gateway running a firmware version vulnerable to CVE-2019-11510 (arbitrary file read). Manual verification confirmed the vulnerability was exploitable, and the extracted configuration files contained encrypted passwords that were cracked offline, leading to full network compromise.
• Shadow IT discovery: During a routine vulnerability scan, an arp-scan discovered an undocumented development server on a production VLAN. Nikto scanning revealed it was running an unpatched Apache Tomcat instance with the manager application exposed using default credentials — a direct path to remote code execution.
• Compliance-driven remediation tracking: A quarterly PCI DSS vulnerability assessment tracked 847 findings across 120 assets. By implementing Nuclei-based continuous scanning with automated ticket creation, the organization reduced its mean time to remediate Critical findings from 45 days to 8 days over three assessment cycles.

Detection and Evasion

Defenders can detect vulnerability scanning through: spikes in network traffic to multiple ports from a single source, unusual User-Agent strings in web server logs (Nikto, Nuclei), SNMP community string brute force attempts, and increased DNS reverse lookups. IPS/IDS systems like Snort and Suricata have signatures for common scanning tools. To reduce scan detection footprint: use slow timing templates (nmap -T2), distribute scans across multiple source IPs, use Nuclei's rate-limiting flags, and perform authenticated scans where possible since credential-based access generates fewer alert signatures. For stealthy web scanning, use custom Nuclei templates with modified HTTP headers matching the target's expected traffic patterns.

Advanced Techniques

Advanced vulnerability assessment goes beyond running scanners and interpreting reports. Techniques include: authenticated scanning with domain credentials for comprehensive internal assessment, custom Nuclei template development for proprietary applications that community templates do not cover, chaining low-severity findings into high-impact exploit paths through manual analysis, using CVSS environmental metrics to adjust base scores based on the specific deployment context, and implementing risk-based prioritization that factors in asset value, exposure, and threat intelligence beyond the raw CVSS score.

Tool Comparison Matrix

Performance and Remediation

Scan performance varies dramatically by tool configuration and target size. OpenVAS full scans of a /24 network can take 4-8 hours. Use OpenVAS's "Discovery" scan config for initial asset identification before running deeper scans. Nuclei template scanning is significantly faster (minutes per host) but covers only template-defined vulnerabilities. For time-constrained engagements, run parallel tool instances and merge results. Structure remediation in four tiers: immediate patching for Critical vulnerabilities with known exploits, scheduled patching for High vulnerabilities, risk acceptance with compensating controls for Medium vulnerabilities, and monitoring-only for Low/Info findings. Track remediation metrics (mean time to remediate, percentage closed, new findings per scan) to demonstrate security posture improvement.

Hacker Laws

• Murphy's Security Law: Systems that can go wrong, will go wrong. The assumption of vulnerability assessment is that systems always have undiscovered security weaknesses, and the purpose of scanning is to find them before attackers do. A scan that finds no vulnerabilities doesn't mean the system is secure — it only means current tools and methods didn't detect them.
• Minimize Attack Surface: Every open port, running service, and default configuration is a potential attack entry point. The primary recommendation of vulnerability assessment is always to disable unnecessary services, tighten default configurations, and reduce the exposed surface.
• Defense in Depth: No single scanning tool can cover all vulnerability types. OpenVAS covers infrastructure, Nuclei covers web applications, and Lynis covers system configurations; multiple tools working together are needed to form a complete vulnerability view.
• Assume Breach: Vulnerability assessment should not assume the network perimeter is secure. Internal network asset vulnerability scanning is equally important because attackers may have already obtained initial internal access through phishing or other means.

Learning Resources

This skill's supplementary files: payloads.md, test-cases.md Related skills: skills/network-pentest/SKILL.md, skills/web-sqli/SKILL.md External resources:

• NIST NVD - National Vulnerability Database - CVE detail lookup and CVSS calculator
• FIRST CVSS v3.1 Calculator - Online CVSS vector calculator
• Nuclei Templates - Community-maintained vulnerability detection template library
• OpenVAS / GVM Documentation - Open-source vulnerability scanner deployment and usage guide
• OWASP Vulnerability Management - Vulnerability management and disclosure best practices