Skip to content

07 — Vulnerability Analysis

What you'll learn: what a vulnerability, a CVE, and a CVSS score actually are; how to hunt for known weaknesses with searchsploit, nmap --script vuln, nikto, wpscan, and the full OpenVAS/GVM scanner; and — the part beginners skip — how to triage findings by real risk and confirm them before you ever try to exploit. Prerequisites: 06 — Enumeration. ⬅️ Course index

Chapter 06 told you what is running on the target (services, versions, shares, users). This chapter asks the next question: which of those things is weak, and how weak? That is vulnerability analysis (VA) — you find and rank weaknesses. You do not break in yet; that starts in chapter 08. Keeping those two apart is a professional habit (and a CEH exam point). The exam theory behind everything here lives in Module 05 — read it alongside this chapter.

⚖️ Lab only. Every command below targets your own Metasploitable2 (192.168.56.20, deliberately vulnerable) or the lab Docker web app (localhost:8081). Running these against anything else is a crime.

What is a vulnerability? (CVE and CVSS in plain English)

A vulnerability is a flaw that lets someone do something they shouldn't — read a file, run a command, crash a service, log in without a password. When a flaw becomes publicly known, it gets a permanent ID so everyone talks about the same thing:

Term Plain meaning Example
Vulnerability The flaw itself An old FTP server with a hidden backdoor
CVE The unique ID for one specific known flaw CVE-2011-2523 (the vsftpd 2.3.4 backdoor)
CVSS A severity score from 0.0 to 10.0 9.8 = very bad
Exploit Working code that abuses a vulnerability A Metasploit module or a Python script

CVSS (Common Vulnerability Scoring System) rates how bad a flaw could be. Higher = worse. It comes with named severity bands you'll see everywhere:

Rating CVSS band
None 0.0
Low 0.1 – 3.9
Medium 4.0 – 6.9
High 7.0 – 8.9
Critical 9.0 – 10.0

Look a CVE up on the free databases to read its score and description: NVD (https://nvd.nist.gov) or cve.org. NVD hangs a CVSS score, a weakness type (CWE), and a product name (CPE) on every CVE — the identifier alphabet soup is explained in Module 05.

Severity is not priority — triage by real risk

A high CVSS score means "this could be catastrophic," not "fix this first." Real-world prioritisation adds two questions the score ignores: can it actually be reached, and does an exploit exist?

Signal The question it answers Where to check
CVSS How bad could it be? NVD / the scanner report
Exploit available? Is there working attack code? searchsploit, Exploit-DB, Metasploit
EPSS How likely is it to be exploited soon? https://www.first.org/epss/
CISA KEV Is it already being exploited in the wild? https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Exposure Is it Internet-facing? Reachable from where you are? Your nmap results (chapter 05)

A Medium flaw that is exposed and has a public exploit beats a Critical one buried on an unreachable port. And always confirm before you exploit — scanners guess, so verify a finding is real (with a targeted script or a manual check) before you rely on it.

searchsploit — offline Exploit-DB in your terminal

Exploit-DB is a huge public archive of exploit code. searchsploit is a local copy of it that ships with Kali, so it works with no internet. This is where you turn a version number from chapter 05 into a known exploit.

searchsploit vsftpd 2.3.4         # search for a service + version you found earlier
# You should see: "vsftpd 2.3.4 - Backdoor Command Execution" and an EDB-ID number (17491)

searchsploit samba 3.0.20         # the Samba "usermap_script" flaw (CVE-2007-2447)
# You should see: a "Samba ... usermap_script" Metasploit module row

searchsploit -m 17491             # -m = MIRROR (copy) that exploit into your current folder
# You should see: "Copied to: /home/kali/17491.rb" — now you can read it

searchsploit -w samba 3.0.20      # -w = show the Exploit-DB WEBSITE links instead of paths
searchsploit -u                   # -u = UPDATE the local database (do this occasionally)
Read the exploit you copied (less 17491.rb) before trusting it — you want to understand what it does, and never run code you haven't glanced at. Keep the versions you noted in chapter 05 next to you; searching by exact version is how you avoid drowning in irrelevant results.

nmap --script vuln — the scanner you already have

Nmap's NSE (Nmap Scripting Engine) includes a whole category of vuln scripts that check for known flaws while it scans. Pair it with -sV so Nmap knows the versions it's judging.

sudo nmap -sV --script vuln 192.168.56.20
# Runs every "vuln" script against detected services. Slow — go make coffee.
# You should see: findings tagged VULNERABLE, often with CVE IDs and Exploit-DB links.

nmap -p 21 --script ftp-vsftpd-backdoor 192.168.56.20
# A TARGETED check for one specific flaw — much faster than the whole category.
# You should see: "State: VULNERABLE" for the vsftpd 2.3.4 backdoor on port 21.
Targeted scripts (one flaw, named -p port) are how you confirm a broad finding cheaply.

nikto — web server weaknesses

nikto scans a web server for thousands of known issues: dangerous files, outdated software, risky headers, default pages. It's noisy and unstealthy — perfect for a lab, obvious on a real network.

nikto -h http://192.168.56.20             # scan Metasploitable2's Apache on port 80
# You should see: "+ Server: Apache/2.2.8", outdated-software warnings, and /OSVDB-* items.

nikto -h http://localhost:8081            # the lab Docker web app
nikto -h http://192.168.56.20 -p 80,8080  # -p = check several ports at once
nikto -o nikto-report.html -Format html -h http://192.168.56.20   # save a tidy report
# You should see: "nikto-report.html" written — open it in Firefox to read the findings.

wpscan — WordPress users, plugins, and versions

If a site runs WordPress, wpscan is the specialist: it fingerprints the version, lists installed plugins/themes (the usual weak spot), and can enumerate usernames for later password attacks.

wpscan --url http://localhost:8081 --enumerate u
# -e u = enumerate USERS. You should see a table of discovered usernames.

wpscan --url http://localhost:8081 --enumerate vp,u
# vp = Vulnerable Plugins, u = users. You should see plugin names + version flags.

wpscan --url http://localhost:8081 --enumerate vp --api-token YOUR_TOKEN
# A free token from wpscan.com adds CVE/vuln data to the plugin findings.
# You should see: "[!] Title: ... | References: CVE-..." next to outdated plugins.
No token? wpscan still finds versions, users, and plugins — you just look the CVEs up yourself on NVD.

OpenVAS / Greenbone (GVM) — the full-scale scanner

The tools above check specific things. OpenVAS, now part of the Greenbone Vulnerability Management (GVM) suite, is a comprehensive scanner: it probes a target against tens of thousands of tests and hands you a ranked report with CVEs and CVSS scores. It runs as a web app.

sudo gvm-setup          # ONE-TIME setup: downloads the vulnerability feeds. VERY slow (30–60+ min).
# You should see: it print an admin password at the end — copy it somewhere safe.

sudo gvm-check-setup    # verify everything installed correctly (fix anything it flags)
sudo gvm-start          # start the services and the web UI
# You should see: it launch and mention https://127.0.0.1:9392
Then work in the browser: 1. Open https://localhost:9392 (accept the self-signed certificate warning — it's local) and log in as admin with the password from setup. 2. Configuration → Targets → New Target, hostname 192.168.56.20. 3. Scans → Tasks → New Task, pick that target and the "Full and fast" scan config (the sensible default), then Save and press the ▶ Start button. 4. Wait — a full scan takes a while. When Status reaches Done, open the task and read the Results: each row is a finding with a severity/CVSS and often a CVE. Sort by severity, but remember: rank by real risk, not the raw number.

False positives and false negatives

Scanners are guessers, especially without login credentials. Two ways they're wrong:

Result Meaning Why it matters
False positive Flags a flaw that isn't really there Wastes time; erodes trust in the report — always confirm
False negative Misses a flaw that is really there The dangerous one — silent exposure you never see

A credentialed scan (you give the scanner a low-privilege login) sees the actual patch level instead of guessing from banners, cutting both kinds of error dramatically.

Common beginner mistakes

  • Treating CVSS as a to-do list. Highest score ≠ fix first. Add exploit availability + exposure (see the triage table).
  • Trusting a single scanner finding. Confirm with a targeted check before you report or exploit it — that's how you dodge false positives.
  • Skipping the version. searchsploit apache returns noise; searchsploit apache 2.2.8 returns answers. Use the versions from chapter 05.
  • Rushing gvm-setup. The feed sync is genuinely slow the first time; let it finish, don't Ctrl+C halfway.
  • Forgetting sudo on --script vuln. Some probes need raw sockets and quietly do less without root.
  • Running these on the internet. Nikto and OpenVAS are loud and, off your lab, illegal.

✅ Practice task

  1. From chapter 05 you have versions for Metasploitable2. Run searchsploit vsftpd 2.3.4 and searchsploit samba 3.0.20; searchsploit -m the vsftpd one and read it with less.
  2. Run sudo nmap -sV --script vuln 192.168.56.20 and save it: add -oN vuln-scan.txt. Then confirm one finding with a targeted script (--script ftp-vsftpd-backdoor).
  3. Run nikto -h http://192.168.56.20 and, if it's WordPress, wpscan --url http://localhost:8081 --enumerate vp,u.
  4. Pick your scariest finding. Look up its CVE on NVD, record the CVSS score, then check the CISA KEV catalog. Would exposure + exploit availability change its priority versus a higher-CVSS finding on an unreachable port? Write your reasoning in your notes.
  5. (Optional, patient) Run sudo gvm-setup, then sudo gvm-start, and launch a "Full and fast" scan of 192.168.56.20. Compare its report to what your quick tools found.

Next

➡️ 08 — Web application hacking: turning web-layer findings into real access with Burp Suite, ffuf, and sqlmap.

Sources

  • Exploit-DB & SearchSploit — https://www.exploit-db.com/searchsploit
  • Nmap NSE vuln category — https://nmap.org/nsedoc/categories/vuln.html
  • Nikto — https://github.com/sullo/nikto
  • WPScan — https://wpscan.com/wordpress-security-scanner/
  • Greenbone / OpenVAS (GVM) — https://greenbone.github.io/docs/ · https://www.openvas.org/
  • NIST National Vulnerability Database (NVD) — https://nvd.nist.gov/
  • FIRST — CVSS specification — https://www.first.org/cvss/
  • CISA — Known Exploited Vulnerabilities (KEV) — https://www.cisa.gov/known-exploited-vulnerabilities-catalog