Ethical Hacking Vulnerability Assessment

A vulnerability is a weakness in a system that an attacker could use. A vulnerability assessment is a structured search for those weaknesses. The goal is a ranked list of problems that the owner can fix, starting with the most dangerous.

Assessment vs Penetration Test

People often mix up the two ideas. An assessment finds and lists weaknesses. A penetration test goes further and tries to use them to show real impact.

Point	Vulnerability Assessment	Penetration Test
Goal	Find as many weaknesses as possible	Prove what an attacker could reach
Method	Mostly automated scans	Manual skill plus tools
Depth	Wide	Deep
Frequency	Monthly or quarterly	Yearly or after big changes

Think of a home check. An assessment walks around and notes every unlocked window. A penetration test climbs through one window to show how far a thief could go.

The Assessment Process

[Find Assets]  -->  [Scan]  -->  [Review Results]
                                        |
                                        v
[Re-scan]  <--  [Fix Problems]  <--  [Rank by Risk]

Step 1: Find Assets

A team cannot protect what it does not know about. List every server, laptop, website, and device.

Step 2: Scan

Scanners compare each asset against a large database of known weaknesses. Popular scanners include Nessus, OpenVAS, and Nikto.

Step 3: Review Results

Scanners make mistakes. A false positive reports a problem that does not exist, and a false negative misses a real one. Analysts check each important finding by hand.

Step 4: Rank by Risk

Not every weakness deserves the same urgency. Analysts weigh how easy the attack is, how much damage it causes, and how exposed the system is to the internet.

Step 5: Fix and Re-scan

Teams patch software, change settings, or remove unused services. A second scan confirms that the fix worked.

Understanding CVE and CVSS

A CVE number gives each known weakness a unique name, such as CVE-2021-44228. Everyone around the world uses the same name, so reports stay clear.

CVSS gives each weakness a score from 0 to 10. Higher scores mean higher danger.

Score	Level
0.1 to 3.9	Low
4.0 to 6.9	Medium
7.0 to 8.9	High
9.0 to 10.0	Critical

Common Weakness Types

• Missing security patches on operating systems and software.
• Default usernames and passwords left unchanged.
• Open ports that serve no business purpose.
• Weak encryption settings.
• Misconfigured file sharing and cloud storage.

Types of Scans

Authenticated Scan

The scanner logs in with a test account and inspects the inside of the system. Results are more accurate.

Unauthenticated Scan

The scanner views the system as an outsider. This view shows what any visitor on the internet can see.

Example Result

Server: web01
Issue : Outdated Apache version
CVE   : listed in scanner database
CVSS  : 8.1 (High)
Fix   : Update to the latest stable version

Scanning Safely

Scans create network traffic and sometimes slow down fragile systems. Schedule scans in quiet hours, tell the operations team, and stay inside the approved scope. Scan only systems you own or have written approval to test.

Good Habits

Run scans on a regular schedule. Keep scanner databases current. Track each finding until someone closes it. Share results in plain language so that managers understand which fixes matter most.