1|Page
Vulnerability Analysis
Index:
1. What is Vulnerability? 2
2. Vulnerability research 2
3. Resources for vulnerability research 2
4. Vulnerability Assessment 2
5. Vulnerability scoring system and databases 2-3
6. Using Armitage 3-6
7. Vulnerability management life cycle 6
8. Vulnerability Assessment Phase 7
9. Post Assessment Phase 7
10. Types of Vulnerability Assessment 7
11. Vulnerability Assessment tools 8
12. Perform Vulnerability Research in Common Weakness Enumeration (CWE) 8-9
13. Perform Vulnerability Research in Common Vulnerability Exposures (CVE) 9-10
14. Perform Vulnerability Research in National Vulnerability Database (NVD) 11-12
15. Perform Vulnerability Analysis using Nessus 12-15
2|Page
What is Vulnerability?
In cybersecurity and ethical hacking, a vulnerability is a flaw or weakness in software, hardware, or
processes that attackers can exploit to gain unauthorized access, disrupt operations, or steal data.
Identifying and addressing these vulnerabilities helps organizations protect systems from threats and
prevent potential security breaches.
Vulnerability research:
In cybersecurity and ethical hacking, vulnerability research is the process of identifying, analyzing,
and documenting flaws or weaknesses in software, hardware, networks, or protocols. Researchers
use various tools and techniques to discover new vulnerabilities, assess their impact, and report
them responsibly to vendors or organizations to improve security.
Resources for Vulnerability Research:
1. Vulnerability Databases: NVD, CVE
2. Bug Bounty Platforms: HackerOne, Bugcrowd
3. Communities & Forums: Reddit /r/netsec, Stack Exchange
4. Research Blogs: Google Project Zero, The Hacker News
5. Security Conferences: DEF CON, Black Hat
Vulnerability assessment:
Vulnerability assessment is the process of identifying, analyzing, and prioritizing security weaknesses
in systems, networks, or applications. It involves scanning for known vulnerabilities, assessing their
potential impact, and providing recommendations for mitigation. This proactive approach helps
organizations strengthen defenses and reduce the risk of exploitation by attackers.
Vulnerability scoring system and databases:
1. CVSS (Common Vulnerability Scoring System):
A standardized framework for rating the severity of vulnerabilities, using metrics for
exploitability, impact, and environmental factors to provide a numerical score.
2. CVE (Common Vulnerabilities and Exposures):
A public database that catalogs known security vulnerabilities, providing a unique identifier
for each vulnerability to facilitate sharing and referencing among security professionals.
3|Page
3. NVD (National Vulnerability Database):
A comprehensive repository maintained by NIST, which contains security vulnerability
information, including CVSS scores, and provides additional metadata for vulnerabilities
listed in the CVE database.
4. OWASP (Open Web Application Security Project):
A project that provides resources and tools for improving web application security, including
the OWASP Top Ten, which lists the most critical web application vulnerabilities.
5. CWE (Common Weakness Enumeration)
A community-developed list of software and hardware weakness types. CWE provides a
standardized classification of common programming errors, helping developers and security
professionals identify and mitigate potential security flaws in their systems. It serves as a
reference for improving software security practices.
Using Armitage:
Connect it to the local host:
4|Page
5|Page
6|Page
Vulnerability-Management Life Cycle:
7|Page
Vulnerability Assessment Phase:
Post Assessment Phase:
The Post-Assessment Phase in ethical hacking involves analyzing results, generating detailed reports,
and presenting findings to stakeholders. It includes identifying vulnerabilities, assessing risks, and
providing recommendations for mitigation. This phase ensures knowledge transfer, facilitates
remediation, and may involve retesting to confirm that security flaws have been effectively resolved.
Types of Vulnerability Assessment:
Vulnerability Assessment Tools:
8|Page
Here are some of the most famous and widely used vulnerability assessment tools:
Nessus
OpenVAS
QualysGuard
Burp Suite
OWASP ZAP (Zed Attack Proxy)
Rapid7 Nexpose
Acunetix
Perform Vulnerability Research in Common Weakness Enumeration:
Open the link https://cwe.mitre.org/
9|Page
Perform Vulnerability Research in Common Vulnerability Exposures (CVE):
Open the link: https://cve.mitre.org/
10 | P a g e
11 | P a g e
Perform Vulnerability Research in National Vulnerability Database (NVD):
Open the link: https://nvd.nist.gov/
12 | P a g e
Perform Vulnerability Analysis using OpenVAS:
Perform Vulnerability Analysis using Nessus:
13 | P a g e
14 | P a g e
15 | P a g e
