Vulnerability Scanning Concepts

Relax. We'll talk through this in plain words — no textbook voice.

What you'll walk away with

Understand Vulnerability Scanning Concepts without the intimidation factor
Get hands-on running tools yourself in an authorized lab environment
Be ready to apply this concept directly in a real assessment/report

Let's think about this for a moment

CVE (Common Vulnerabilities and Exposures) is a database that tracks each publicly-known vulnerability under a unique ID (for example, CVE-2021-44228, Log4Shell) — security researchers and vendors request a CVE ID and register it publicly whenever they find a vulnerability. A vulnerability scanner (Nessus, OpenVAS) automatically matches a target's service versions (found via Nmap) against the CVE database and auto-generates a report saying 'this system may have these known vulnerabilities.' A false positive is when the scanner reports a vulnerability that doesn't actually exist (which is exactly why manual verification is needed).

Let's connect it to a real scenario

Scan your lab VM with OpenVAS (an open-source vulnerability scanner) and it'll show you a list of CVE IDs (for example, the CVE for the vsftpd 2.3.4 backdoor vulnerability) along with a risk severity rating (Critical/High/Medium/Low) — when writing a pentest report (Advanced chapter), this scan result is often used as your base data, though it's still worth doing manual verification, since false positives happen.

CVE = a database that tracks publicly-known vulnerabilities under unique IDs
Vulnerability scanner (Nessus, OpenVAS) = auto-matches service versions against the CVE database
False positive = a case the scanner reported that isn't actually real — manual verification is needed

Let's look at an example together

text

How vulnerability scanning fits the workflow:

1. Nmap finds: "vsftpd 2.3.4 is running on port 21"
2. Scanner checks CVE database for "vsftpd 2.3.4"
3. Finds a match: known backdoor vulnerability
4. Reports: Critical severity, with the CVE reference
5. Pentester manually verifies before including it in the report
   (automated tools can misreport version strings)

You should see

Be able to explain the concepts of CVE, vulnerability scanner, and false positive with examples.

Try it in 5 minutes

Open up a CVE database (cve.org or nvd.nist.gov) and look up a well-known CVE (for example, Log4Shell, CVE-2021-44228) — write down what the severity score (CVSS) actually refers to.

A quick word of caution

Running a vulnerability scanner against a production system (even with authorization) can spike system load and hurt performance — coordinate a maintenance window with the client ahead of time.

Easy traps

Blindly trusting an automated scanner report as 'every finding here is real' without manual verification — false positives are common
Assuming that a CVE ID automatically means 'there's a working exploit available' — a CVE simply documents that a vulnerability exists; whether exploit code exists is a separate question

Now try it yourself

Open up a CVE database (cve.org or nvd.nist.gov) and look up a well-known CVE (for example, Log4Shell, CVE-2021-44228) — write down what the severity score (CVSS) actually refers to.

You'll know it worked when: Be able to explain the concepts of CVE, vulnerability scanner, and false positive with examples.