01. Vulnerabilities

What is Vulnerability Assessment?¶

A Vulnerability Assessment (VA) is the process of identifying, analyzing, and prioritizing security weaknesses in systems, networks, or applications.

According to National Institute of Standards and Technology:

A vulnerability is a weakness that can be exploited to compromise confidentiality, integrity, or availability.

Key Idea:¶

VA is defensive
Focus = Find weaknesses
Does NOT necessarily exploit them (that’s Pentesting)

Difference: Vulnerability Assessment vs Penetration Testing¶

Feature	Vulnerability Assessment	Penetration Testing
Goal	Identify vulnerabilities	Exploit vulnerabilities
Depth	Broad	Deep
Approach	Automated + Manual	Mostly manual
Output	List of vulnerabilities	Proof of exploitation
Frequency	Regular (weekly/monthly)	Periodic

Types of Vulnerabilities (Deep Understanding)¶

Software Vulnerabilities¶

Weaknesses in application logic or code.

Examples:

SQL Injection
Cross-Site Scripting (XSS)
Remote Code Execution (RCE)

Why they occur:

Poor input validation
Unsafe libraries
Developer mistakes

Network Vulnerabilities¶

Weaknesses in network infrastructure.

Examples:

Open ports (e.g., 21, 23, 3389)
Weak protocols (Telnet, FTP)
Misconfigured firewall

Configuration Vulnerabilities¶

Incorrect system settings.

Examples:

Default credentials
Directory listing enabled
Debug mode ON in production

Human Vulnerabilities¶

Human errors or behavior.

Examples:

Phishing
Weak passwords
Social engineering

Hardware Vulnerabilities¶

Flaws in physical devices or firmware.

Examples:

Spectre / Meltdown
Firmware backdoors

Vulnerability Lifecycle¶

Discovery → Disclosure → CVE Assignment → Patch Release → Exploitation (if unpatched)

Explanation:¶

Researcher finds vulnerability
Reports to vendor
Gets CVE ID
Patch released
Attackers exploit if systems not updated

CVE and Standardization¶

Maintained by MITRE Corporation

CVE Format:¶

CVE-YYYY-XXXX

Example:¶

CVE-2021-44228 → Log4Shell

NVD (National Vulnerability Database)¶

Managed by National Institute of Standards and Technology

Provides:¶

CVSS Score
Severity rating
Affected systems
Patch references

CVSS (Common Vulnerability Scoring System)¶

Used to measure severity.

Score Range:¶

Score	Severity
0.0 – 3.9	Low
4.0 – 6.9	Medium
7.0 – 8.9	High
9.0 – 10.0	Critical

Factors:¶

Attack vector (Network, Local)
Complexity
Privileges required
User interaction
Impact (CIA triad)

Real-World Case Study¶

Log4Shell (CVE-2021-44228)¶

Type: Remote Code Execution
Attack Vector: Logging input
Impact: Full system compromise

Why dangerous:

No authentication required
Exploitable over internet
Affects millions of systems

Vulnerability Assessment Methodology¶

Step 1: Asset Discovery¶

Identify all systems.

Tools:

Nmap
Netdiscover

Step 2: Scanning¶

Scan for vulnerabilities.

Tools:

Nessus
OpenVAS
Nikto

Step 3: Enumeration¶

Gather detailed info.

Examples:

Service versions
OS detection
User accounts

Step 4: Analysis¶

Match findings with CVEs
Check severity (CVSS)

Step 5: Prioritization¶

Focus on:

Critical vulnerabilities
Internet-facing systems
Sensitive data systems

Step 6: Reporting¶

Include:

Vulnerability description
Risk level
Proof (screenshots/logs)
Remediation steps

Tools Used in Vulnerability Assessment¶

Network Scanning¶

Nmap
Masscan

Vulnerability Scanners¶

Nessus
OpenVAS
Qualys

Web Testing¶

Burp Suite
Nikto
OWASP ZAP

False Positives vs False Negatives¶

Term	Meaning
False Positive	Reported vulnerability is not real
False Negative	Missed vulnerability

Important:¶

Always validate findings manually

Zero-Day Vulnerabilities¶

Definition:¶

A vulnerability unknown to vendor and unpatched.

Why dangerous:¶

No defense available
High exploitation rate

Risk vs Vulnerability¶

Concept	Meaning
Vulnerability	Weakness
Threat	Potential attacker
Risk	Probability × Impact

Business Impact of Vulnerabilities¶

Data Breach
Financial Loss
Legal Issues
Reputation Damage

Best Practices¶

For Organizations:¶

Regular patching
Use vulnerability scanners
Implement least privilege
Network segmentation

For Pentesters / Students:¶

Learn manual testing
Understand CVE deeply
Practice on:
- HackTheBox
- TryHackMe
- CTFs

How VA Fits in Security¶

Risk Management
 └── Vulnerability Management
      └── Vulnerability Assessment
           └── Penetration Testing

Summary¶

Vulnerability Assessment is foundational in cybersecurity
It helps identify weaknesses before attackers do
Works best when combined with patching + monitoring
Essential skill for:
- Security Analysts
- Pentesters
- SOC Analysts