Vulnerability Discovery and Analysis
This chapter covers finding and evaluating weaknesses. You will learn automated vulnerability scanning, how to validate results and handle false positives, severity scoring with CVSS, and how to prioritize what to address first.
Vulnerability scanning
Automated scanners such as Nessus and OpenVAS check hosts and applications against databases of known vulnerabilities, producing findings quickly across many targets. Scanning is efficient for breadth, but its output is a starting point rather than a conclusion, because scanners can miss context or misidentify issues.
Validation and false positives
A false positive is a reported vulnerability that does not actually exist on the target, and a false negative is a real vulnerability the scanner missed. Because acting on false positives wastes effort and undermines credibility, testers manually validate significant findings before including them, confirming the weakness is genuinely present and exploitable.
Severity scoring with CVSS
The Common Vulnerability Scoring System (CVSS) assigns a standardized severity score from 0 to 10 based on characteristics such as attack vector, complexity, and impact. CVSS provides a common language for severity, but testers still consider the specific environment, because a high base score may matter less on an isolated system and a moderate score may be critical on an exposed one.
Prioritization
With limited time, testers prioritize by risk, which combines a vulnerability's severity with the likelihood and business impact of its exploitation in the target's context. Factors such as exposure to the internet, presence of a known exploit, and the value of the affected asset all raise priority. Cosmetic ordering, such as alphabetical hostnames, does not reflect real risk.