Ethical Hacking Vulnerability Assessment
A vulnerability is a weakness in a system that an attacker could use. A vulnerability assessment is a structured search for those weaknesses. The goal is a ranked list of problems that the owner can fix, starting with the most dangerous.
Assessment vs Penetration Test
People often mix up the two ideas. An assessment finds and lists weaknesses. A penetration test goes further and tries to use them to show real impact.
| Point | Vulnerability Assessment | Penetration Test |
|---|---|---|
| Goal | Find as many weaknesses as possible | Prove what an attacker could reach |
| Method | Mostly automated scans | Manual skill plus tools |
| Depth | Wide | Deep |
| Frequency | Monthly or quarterly | Yearly or after big changes |
Think of a home check. An assessment walks around and notes every unlocked window. A penetration test climbs through one window to show how far a thief could go.
The Assessment Process
[Find Assets] --> [Scan] --> [Review Results]
|
v
[Re-scan] <-- [Fix Problems] <-- [Rank by Risk]
Step 1: Find Assets
A team cannot protect what it does not know about. List every server, laptop, website, and device.
Step 2: Scan
Scanners compare each asset against a large database of known weaknesses. Popular scanners include Nessus, OpenVAS, and Nikto.
Step 3: Review Results
Scanners make mistakes. A false positive reports a problem that does not exist, and a false negative misses a real one. Analysts check each important finding by hand.
Step 4: Rank by Risk
Not every weakness deserves the same urgency. Analysts weigh how easy the attack is, how much damage it causes, and how exposed the system is to the internet.
Step 5: Fix and Re-scan
Teams patch software, change settings, or remove unused services. A second scan confirms that the fix worked.
Understanding CVE and CVSS
A CVE number gives each known weakness a unique name, such as CVE-2021-44228. Everyone around the world uses the same name, so reports stay clear.
CVSS gives each weakness a score from 0 to 10. Higher scores mean higher danger.
| Score | Level |
|---|---|
| 0.1 to 3.9 | Low |
| 4.0 to 6.9 | Medium |
| 7.0 to 8.9 | High |
| 9.0 to 10.0 | Critical |
Common Weakness Types
- Missing security patches on operating systems and software.
- Default usernames and passwords left unchanged.
- Open ports that serve no business purpose.
- Weak encryption settings.
- Misconfigured file sharing and cloud storage.
Types of Scans
Authenticated Scan
The scanner logs in with a test account and inspects the inside of the system. Results are more accurate.
Unauthenticated Scan
The scanner views the system as an outsider. This view shows what any visitor on the internet can see.
Example Result
Server: web01 Issue : Outdated Apache version CVE : listed in scanner database CVSS : 8.1 (High) Fix : Update to the latest stable version
Scanning Safely
Scans create network traffic and sometimes slow down fragile systems. Schedule scans in quiet hours, tell the operations team, and stay inside the approved scope. Scan only systems you own or have written approval to test.
Good Habits
Run scans on a regular schedule. Keep scanner databases current. Track each finding until someone closes it. Share results in plain language so that managers understand which fixes matter most.