LoopyLuci Vulnerability Assessment and Scanning
Performing vulnerability assessments — from automated scanning (Nessus, OpenVAS, Nuclei) through manual verification, risk prioritization, and reporting.
When to Use
- Scanning networks for known vulnerabilities
- Prioritizing vulnerabilities by risk and exploitability
- Automating vulnerability scanning in CI/CD
- Manual verification of scan findings
- Building vulnerability management programs
Scanning Tools
SCANNING_TOOLS = {
'nessus': 'Comprehensive, credentialed scanning, CVSS scoring, compliance checks',
'openvas': 'Open-source, Greenbone Security Assistant, extensive plugin library',
'nuclei': 'YAML-based template scanner — fast, community templates, CI/CD integration',
'nexpose': 'Rapid7 — risk-based scoring, real-time integration with Metasploit',
'qualys': 'Cloud-based, asset management, PCI scanning, continuous monitoring',
}
class VulnerabilityAssessment:
"""Manage vulnerability assessment program."""
def __init__(self):
self.scan_results = []
self.remediated = []
self.accepted_risks = []
def prioritize(self, results: List[Dict]) -> List[Dict]:
"""Prioritize by CVSS score, exploit availability, asset criticality."""
for r in results:
r['priority'] = sum([
r.get('cvss', 0) * 10, # CVSS weight
r.get('exploit_available', 0) * 30, # Exploit weight
r.get('asset_criticality', 0) * 20, # Criticality weight
])
return sorted(results, key=lambda r: r['priority'], reverse=True)
Verification Checklist
- Scanning scope defined (IP ranges, ports, protocols)
- Credentialed scans for authenticated assessment
- Scan tool configured (Nessus, OpenVAS, Nuclei, or combination)
- False positives identified and removed
- Vulnerabilities verified manually (not just scanner output)
- Risk-ranked (CVSS + exploitability + asset criticality)
- Remediation recommendations provided
- Re-scan after remediation to verify fixes
- Executive summary with risk trends over time