Module 05 — Vulnerability Analysis · Must-Know Facts¶
One-page, high-yield recall sheet. If you can reproduce this from memory, you own the module. Pairs with README.md · practice-questions.md · flashcards.csv · lab-walkthrough.md.
The one line¶
VA finds and ranks weaknesses; it does not exploit them — that's the pen test (Module 06+). Breadth, not proof of impact.
The vulnerability-management lifecycle (in order)¶
1. Pre-assess (baseline + asset inventory) → 2. Vulnerability Assessment (scan / identify) → 3. Risk Assessment (rank + CVSS) → 4. Remediation (patch / harden) → 5. Verify (re-scan, confirm fix) → 6. Monitor (continuous reassess). It is a loop: monitoring feeds the next baseline. Verification is a re-scan, not "trust the ticket."
Assessment types & approaches¶
| Type | What | Note |
|---|---|---|
| Active | Sends probes/packets; scanner interacts | Most scanning; noisy, can crash fragile services |
| Passive | Observes traffic only, no probing | Stealthy; sees only what's on the wire |
| External | Outside-attacker / Internet-facing view | Perimeter, exposed services |
| Internal | Inside-the-LAN view | Post-breach / insider; finds far more |
| Host-based | Deep check of one system (patches, config, users) | Often credentialed; agent or login |
| Network-based | Hosts/ports/services across a range | Discovers exposure breadth |
| Application-based | Web/app-layer flaws (input, auth, logic) | Nikto / ZAP / Burp territory |
| Database | DB config, privileges, patch level | Specialized scanner scope |
| Cloud | Cloud posture / misconfig, exposed assets | CSPM-style checks |
Approach pairs CEH names: product-based (installed in your network) vs. service-based (third-party offering); tree-based (auditor picks a strategy per machine) vs. inference-based (scan branches on what it finds); credentialed/authenticated vs. non-credentialed.
Authenticated vs. unauthenticated scans¶
| Authenticated (credentialed) | Unauthenticated (non-credentialed) | |
|---|---|---|
| How | Scanner logs in with an account | Infers from banners/behavior, no login |
| Sees | Actual patch level, config, installed software | Only externally observable signals |
| Result | Far fewer false positives/negatives | More guessing → more false positives |
| View | Insider / post-auth reality | Attacker-at-the-door reality |
Credentialed scans cut both false positives and false negatives by seeing real state instead of guessing.
Identification standards — know owner → standard cold¶
| Acronym | Full name | Owner | Identifies |
|---|---|---|---|
| CVE | Common Vulnerabilities and Exposures | MITRE (cve.org) | A specific known vuln instance, e.g. CVE-2011-2523 |
| CWE | Common Weakness Enumeration | MITRE | The weakness type / root cause class, e.g. CWE-89 SQLi, CWE-79 XSS |
| CPE | Common Platform Enumeration | NIST/NVD | A structured product name string |
| NVD | National Vulnerability Database | NIST | Enriches CVEs with CVSS, CWE, and CPE — the searchable feed |
| CVSS | Common Vulnerability Scoring System | FIRST | The severity score (0.0–10.0) |
Mnemonic: CVE = the bug (instance), CWE = the kind of bug (class), CPE = the product it lives in. NVD ties them together and hangs a CVSS score on each CVE.
CVSS — the three metric groups¶
| Group | Represents | Changes? |
|---|---|---|
| Base | Intrinsic constant traits: Attack Vector, Attack Complexity, Privileges Required, User Interaction, Scope, and C/I/A impact | Fixed over time |
| Temporal (v3.x) / Threat (v4.0) | Exploitation state now: exploit maturity, remediation level, report confidence | Changes over time |
| Environmental | Your org's context: security requirements + modified base metrics for your deployment | Per-organization |
Reason from what each group measures, not a memorized decimal.
CVSS qualitative severity bands (v3.x / v4.0, per FIRST/NVD)¶
| Rating | Score band |
|---|---|
| None | 0.0 |
| Low | 0.1 – 3.9 |
| Medium | 4.0 – 6.9 |
| High | 7.0 – 8.9 |
| Critical | 9.0 – 10.0 |
Gotcha: CVSS v2 had no "Critical" (its top band was High). "Critical" arrived with v3. CVSS v4.0 (2023) renamed Temporal → Threat and added a Supplemental group.
Scoring ≠ prioritization¶
CVSS answers "how bad could this be?" — not "fix which first?". Layer on exploitability + exposure: | Signal | Adds | Source | |---|---|---| | CVSS | Intrinsic severity | FIRST | | EPSS | Probability it will be exploited soon | FIRST | | CISA KEV | Whether it's already exploited in the wild | CISA catalog | | Asset value / exposure | Internet-facing? Tier 0? | Your asset inventory (CPE) |
A Medium CVSS that is Internet-facing and on the KEV list beats a Critical buried on an isolated host.
False positive vs. false negative¶
| Result | Meaning | Consequence |
|---|---|---|
| False positive | Flagged a vuln that isn't real | Wasted effort, alert fatigue |
| False negative | Missed a vuln that is real | Silent exposure — the dangerous one |
Scanner → purpose¶
| Tool | Purpose |
|---|---|
| Nessus (Tenable) | Commercial, industry-standard vuln scanner |
| OpenVAS / Greenbone (GVM) | Open-source network vuln scanner |
| Nikto | Web-server vulnerability scanner (web-only) |
| Qualys VMDR | Cloud-based vulnerability management |
Nmap + NSE vuln |
Service/version detection → CVE correlation |
| searchsploit / Exploit-DB | Map a version to known exploits |
Scanner classes to name: network · host · application · database · cloud.
PAM angle (the exam-rewarded discipline)¶
- The vulnerability scanner is itself a privileged tool — it holds credentials to half your estate.
- Give the credentialed scan a dedicated, least-privilege account (read/config-audit only), vault it, run it just-in-time (JIT), rotate it, and record its sessions. That one practice slashes false positives.
- Detection: the scan account authenticating outside its window or from an odd host should fire.
- Patch the PAM stack itself — Vault/PVWA/CPM/PSM are Tier 0 and need the same patch cadence you demand of everything else.
- Least privilege (EPM) caps the blast radius of any exploited local-privesc CVE.
Top traps¶
- CVE = instance, CWE = weakness class, CPE = product name. Highest-frequency mix-up here.
- NVD is NIST · CVE is MITRE · CVSS is FIRST. Match owner → standard.
- CVSS v2 had no "Critical." That band is v3+.
- Base = constant · Temporal/Threat = changes over time · Environmental = org-specific.
- Credentialed scans → fewer false positives (they see real patch state).
- False negative > false positive in danger — a missed vuln is silent risk.
- VA finds & ranks; it does not exploit — that's the pen test (Module 01 VA-vs-PT split).
- Active sends probes; passive only observes.
- Severity ≠ priority: EPSS (likely exploited) and KEV (already exploited) reorder the list.