Module 05 — Vulnerability Analysis

Understanding vulnerabilities, risk assessment, validation, prioritization, and remediation.

1. What is Vulnerability Analysis?

Definition

Vulnerability Analysis is the process of identifying, analyzing, validating, and prioritizing security weaknesses (vulnerabilities) in systems, networks, applications, or infrastructure before they can be exploited.

The goal is to determine:

• What vulnerabilities exist?
• How severe are they?
• Can they be exploited?
• What impact would exploitation have?
• How should they be remediated?

Simple Definition

Example

Suppose Nmap finds:

80/tcp open http Apache 2.4.49

Scanning only tells us:

Apache is running.

Vulnerability Analysis asks:

• Is Apache 2.4.49 vulnerable?
• What CVEs affect it?
• Can attackers exploit it?
• Is a patch available?
• How severe is it?
• What should be fixed first?

This is Vulnerability Analysis.

2. Vulnerability Analysis vs Exploitation

Example

Vulnerability Analysis

You discover:

Apache 2.4.49

Research shows:

CVE-2021-41773

Severity:

Critical

Recommendation:

Update Apache immediately.

Exploitation

A tester later uses an exploit targeting CVE-2021-41773 to demonstrate the impact in an authorized environment.

3. Why Do We Perform Vulnerability Analysis?

Organizations usually have thousands of devices.

Every device may contain multiple vulnerabilities.

Without analysis:

• Everything looks equally important.
• Security teams don't know what to fix first.
• Resources are wasted.

Why Analyze Vulnerabilities?

Because we need to understand:

• Which systems are vulnerable?
• Which vulnerabilities are exploitable?
• Which pose the greatest business risk?
• Which require immediate remediation?

Why Don't We Exploit Immediately?

Finding a vulnerability does not necessarily mean it should be exploited.

Reasons include:

1. Avoid System Damage

Example:

Production Database

Crashing it could interrupt business operations.

2. Verify the Finding

Scanners sometimes report issues that are not actually exploitable.

Example:

Scanner reports SQL Injection
Manual testing finds none.

That is a false positive.

3. Maintain Stability

Organizations often prefer:

Identify → Validate → Patch

instead of

Identify → Exploit

4. Respect Scope and Authorization

4. Benefits of Vulnerability Validation

Validation confirms whether a reported issue is genuine.

Benefits:

• Removes false positives
• Reduces unnecessary work
• Improves report accuracy
• Prevents incorrect remediation
• Builds confidence in findings

5. Risk Reduction

The purpose is not simply to find vulnerabilities.

The goal is to reduce organizational risk.

Example:

Critical Vulnerability
        │
        ▼
      Patch
        │
        ▼
  Reduced Risk

6. Prioritizing Vulnerabilities

Organizations cannot always fix everything immediately.

Therefore vulnerabilities are prioritized.

Typical order:

Critical
   │
   ▼
  High
   │
   ▼
 Medium
   │
   ▼
  Low
   │
   ▼
Informational

Priority depends on factors such as:

• Severity
• Ease of exploitation
• Business impact
• Internet exposure
• Availability of patches

7. False Positives

Definition

Example:

Scanner:

SQL Injection Found

Manual testing:

No SQL Injection

Result:

False Positive

Why Do False Positives Occur?

• Banner version detection
• Incorrect signatures
• Configuration differences
• Scanner limitations
• Environmental factors

8. Vulnerability Analysis Workflow

Reconnaissance
        │
        ▼
Scanning
        │
        ▼
Enumeration
        │
        ▼
Vulnerability Analysis
        │
        ▼
Validation
        │
        ▼
Risk Assessment
        │
        ▼
Exploitation (if authorized)
        │
        ▼
Reporting
        │
        ▼
Remediation

9. Types of Vulnerabilities

1. Network Vulnerabilities

Weaknesses affecting network infrastructure.

Examples:

• Open ports
• SMBv1 enabled
• Weak TLS configuration
• Insecure network services
• Firewall misconfigurations

2. Web Application Vulnerabilities

Weaknesses in websites or APIs.

Examples:

• SQL Injection
• Cross-Site Scripting (XSS)
• Cross-Site Request Forgery (CSRF)
• File Inclusion
• Command Injection
• Directory Traversal

3. Operating System Vulnerabilities

Weaknesses in Windows, Linux, or other operating systems.

Examples:

• Missing security patches
• Local privilege escalation flaws
• Weak file permissions
• Outdated kernel versions

4. Database Vulnerabilities

Weaknesses affecting databases.

Examples:

• Default credentials
• Weak passwords
• Excessive privileges
• SQL Injection exposure
• Unencrypted data

5. Wireless Vulnerabilities

Weaknesses in wireless networks.

Examples:

• Weak Wi-Fi passwords
• WEP encryption
• Rogue access points
• Evil Twin attacks
• Weak WPA configuration

6. Configuration Weaknesses

Security issues caused by poor configuration.

Examples:

• Default credentials
• Default settings
• Open directory listing
• Public cloud storage
• Debug mode enabled

7. Authentication Weaknesses

Weaknesses in user authentication.

Examples:

• Weak passwords
• Password reuse
• No MFA
• Predictable passwords
• Default accounts

8. Authorization Issues

Users can access resources they should not.

Examples:

• Insecure Direct Object References (IDOR)
• Broken Access Control
• Privilege escalation
• Horizontal privilege escalation
• Vertical privilege escalation

9. Business Logic Issues

Application behavior can be abused without exploiting a software bug.

Examples:

• Applying a coupon multiple times
• Bypassing payment steps
• Purchasing items at incorrect prices
• Abuse of referral systems

10. Cryptographic Weaknesses

Problems related to encryption and key management.

Examples:

• Weak hashing algorithms (MD5, SHA-1)
• Weak SSL/TLS configuration
• Hardcoded encryption keys
• Poor random number generation

10. Vulnerability Severity Levels

Critical

• Immediate exploitation is likely.
• Major impact on confidentiality, integrity, or availability.
• Requires urgent remediation.

Example:

Remote Code Execution

High

• Significant risk.
• Exploitable with some conditions.
• Should be remediated quickly.

Example:

SQL Injection

Medium

• Moderate impact.
• May require user interaction or specific conditions.

Example:

Directory Listing Enabled

Low

• Limited security impact.
• Usually combined with other issues.

Example:

Server Version Disclosure

Informational

• Not a vulnerability by itself.
• Useful for security awareness.

Example:

Server Banner Disclosure

11. CVE (Common Vulnerabilities and Exposures)

Example:

CVE-2021-41773

A CVE identifies which vulnerability is being discussed.

12. CVSS (Common Vulnerability Scoring System)

CVSS provides a numerical severity score.

Typical ranges:

CVSS answers:

13. CWE (Common Weakness Enumeration)

A CWE describes the underlying software weakness that leads to vulnerabilities.

Examples:

• CWE-79 → Cross-Site Scripting
• CWE-89 → SQL Injection
• CWE-287 → Improper Authentication

Think of CWE as the category of weakness.

14. CAPEC (Common Attack Pattern Enumeration and Classification)

CAPEC documents common attack techniques used by attackers.

Example:

• SQL Injection attack pattern
• Cross-Site Scripting attack pattern
• Phishing attack pattern

CAPEC answers:

15. Relationship Between CVE, CVSS, CWE, and CAPEC

16. Vulnerability Analysis Tools

1. Nessus Essentials

Purpose

• Industry-standard vulnerability scanner
• Detects CVEs, missing patches, weak configurations, and security misconfigurations
• Generates detailed reports

Why use it?

• Fast
• Accurate
• Excellent reporting
• Enterprise standard

Platform: Windows, Linux, macOS

Download: Nessus Essentials

2. OpenVAS (Greenbone)

Purpose

• Free, open-source vulnerability scanner
• Detects known vulnerabilities and configuration issues

Why use it?

• Completely free
• Large vulnerability database
• Good alternative to Nessus

Platform: Linux, Docker

Download: Greenbone Community Edition

3. Nmap NSE

Purpose

• Detects known vulnerabilities using Nmap scripts
• Performs service-specific security checks

Why use it?

• Fast
• Lightweight
• Ideal for quick vulnerability checks

Platform: Windows, Linux, macOS

Download: Nmap Downloads

4. Nikto

Purpose

• Web server vulnerability scanner

Finds

• Outdated software
• Dangerous files
• Misconfigurations
• Default pages

Download: Nikto GitHub

5. Burp Suite Community

Purpose

• Manual web application security testing

Finds

• SQL Injection
• XSS
• IDOR
• Authentication flaws

Download: Burp Suite Community Edition

6. OWASP ZAP

Purpose

• Automated web application vulnerability scanner

Finds

• XSS
• SQL Injection
• Missing security headers
• Weak cookies

Download: OWASP ZAP

7. WPScan

Purpose

• WordPress vulnerability scanner

Finds

• Vulnerable plugins
• Vulnerable themes
• Outdated WordPress
• User enumeration

Download: WPScan Official Site