Vulnerability Scanning

Vulnerability Scanning

Identify and prioritize security vulnerabilities across infrastructure and applications.

When to Use This Skill

Use this skill when:

• Performing security assessments
• Implementing vulnerability management programs
• Meeting compliance requirements
• Triaging and prioritizing remediation
• Scanning infrastructure for known CVEs

Prerequisites

• Access to scanning tools
• Network access to targets
• Appropriate authorization

Vulnerability Scanning Tools

OpenVAS Setup

Docker Deployment

# Run OpenVAS container
docker run -d --name openvas \
  -p 443:443 \
  -v openvas-data:/data \
  greenbone/openvas-scanner

# Access web UI at https://localhost
# Default credentials: admin/admin

Scanning Commands

# Create target
omp -u admin -w admin --xml='<create_target>
  <name>Web Servers</name>
  <hosts>192.168.1.0/24</hosts>
</create_target>'

# Create task
omp -u admin -w admin --xml='<create_task>
  <name>Weekly Scan</name>
  <target id="target-uuid"/>
  <config id="daba56c8-73ec-11df-a475-002264764cea"/>
</create_task>'

# Start task
omp -u admin -w admin --xml='<start_task task_id="task-uuid"/>'

# Get results
omp -u admin -w admin --xml='<get_results task_id="task-uuid"/>'

Nessus

API Usage

import requests

class NessusScanner:
    def __init__(self, url, access_key, secret_key):
        self.url = url
        self.headers = {
            'X-ApiKeys': f'accessKey={access_key}; secretKey={secret_key}',
            'Content-Type': 'application/json'
        }
    
    def create_scan(self, name, targets, template='basic'):
        """Create a new scan."""
        templates = self.get('/editor/scan/templates')
        template_uuid = next(
            t['uuid'] for t in templates['templates'] 
            if t['name'] == template
        )
        
        payload = {
            'uuid': template_uuid,
            'settings': {
                'name': name,
                'text_targets': targets,
                'enabled': True
            }
        }
        return self.post('/scans', payload)
    
    def launch_scan(self, scan_id):
        """Start a scan."""
        return self.post(f'/scans/{scan_id}/launch')
    
    def get_results(self, scan_id):
        """Get scan results."""
        return self.get(f'/scans/{scan_id}')
    
    def export_report(self, scan_id, format='pdf'):
        """Export scan report."""
        payload = {'format': format}
        response = self.post(f'/scans/{scan_id}/export', payload)
        file_id = response['file']
        
        # Wait for export
        while True:
            status = self.get(f'/scans/{scan_id}/export/{file_id}/status')
            if status['status'] == 'ready':
                break
            time.sleep(5)
        
        return self.get(f'/scans/{scan_id}/export/{file_id}/download')
    
    def get(self, path):
        response = requests.get(f'{self.url}{path}', headers=self.headers, verify=False)
        return response.json()
    
    def post(self, path, data=None):
        response = requests.post(f'{self.url}{path}', json=data, headers=self.headers, verify=False)
        return response.json()

# Usage
scanner = NessusScanner('https://nessus:8834', 'access-key', 'secret-key')
scan = scanner.create_scan('Weekly Infrastructure Scan', '10.0.0.0/24')
scanner.launch_scan(scan['scan']['id'])

Nuclei

Installation

# Install nuclei
go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest

# Or download binary
wget https://github.com/projectdiscovery/nuclei/releases/latest/download/nuclei_linux_amd64.zip
unzip nuclei_linux_amd64.zip

Basic Scanning

# Update templates
nuclei -update-templates

# Scan single target
nuclei -u https://example.com

# Scan multiple targets
nuclei -l targets.txt

# Scan with specific templates
nuclei -u https://example.com -t cves/
nuclei -u https://example.com -t vulnerabilities/

# Scan with severity filter
nuclei -u https://example.com -s critical,high

# Output formats
nuclei -u https://example.com -o results.txt
nuclei -u https://example.com -json -o results.json

Custom Templates

# custom-check.yaml
id: custom-admin-panel

info:
  name: Admin Panel Detection
  author: security-team
  severity: info
  tags: recon,panel

requests:
  - method: GET
    path:
      - "{{BaseURL}}/admin"
      - "{{BaseURL}}/administrator"
      - "{{BaseURL}}/wp-admin"
    
    matchers-condition: or
    matchers:
      - type: word
        words:
          - "admin"
          - "login"
        condition: and
      
      - type: status
        status:
          - 200
          - 301
          - 302

CVSS Scoring

Severity Levels

Prioritization Factors

prioritization_criteria:
  critical_factors:
    - Internet-facing systems
    - Systems with sensitive data
    - Active exploitation in the wild
    - Authentication bypass
    
  high_factors:
    - Remote code execution
    - Privilege escalation
    - Data exfiltration risk
    
  context_adjustments:
    - Compensating controls in place (-1)
    - No direct exposure (-1)
    - Critical business system (+1)
    - Compliance requirement (+1)

Vulnerability Management Process

Workflow

vulnerability_workflow:
  discovery:
    - Run scheduled scans
    - Import third-party findings
    - Correlate with asset inventory
    
  analysis:
    - Validate findings
    - Remove false positives
    - Assess business impact
    - Prioritize by risk score
    
  remediation:
    - Assign to owners
    - Track SLA compliance
    - Verify fixes
    - Document exceptions
    
  reporting:
    - Executive summaries
    - Technical details
    - Trend analysis
    - Compliance metrics

Tracking Template

## Vulnerability Ticket

**ID:** VULN-2024-001
**CVE:** CVE-2024-12345
**CVSS:** 9.8 (Critical)
**Affected System:** web-server-01

### Description
Remote code execution vulnerability in Apache Struts.

### Impact
Attacker can execute arbitrary code on the server.

### Remediation
1. Update Apache Struts to version 2.5.33
2. Apply WAF rule as temporary mitigation

### Timeline
- Discovered: 2024-01-15
- SLA Due: 2024-01-16
- Remediated: 2024-01-15

### Evidence
- Scan report: [link]
- Screenshot: [link]

CI/CD Integration

GitHub Actions

name: Vulnerability Scan

on:
  schedule:
    - cron: '0 2 * * *'
  push:
    branches: [main]

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Run Nuclei
        uses: projectdiscovery/nuclei-action@main
        with:
          target: https://example.com
          templates: cves/
          output: nuclei-results.txt

      - name: Check for critical findings
        run: |
          if grep -q "critical" nuclei-results.txt; then
            echo "Critical vulnerabilities found!"
            exit 1
          fi

      - name: Upload results
        uses: actions/upload-artifact@v4
        with:
          name: vulnerability-report
          path: nuclei-results.txt

Compliance Scanning

CIS Benchmark Scan

# Using OpenSCAP
oscap xccdf eval \
  --profile xccdf_org.ssgproject.content_profile_cis \
  --results results.xml \
  --report report.html \
  /usr/share/xml/scap/ssg/content/ssg-ubuntu2204-ds.xml

PCI DSS Scanning

pci_scan_requirements:
  quarterly:
    - External vulnerability scan (ASV)
    - Internal vulnerability scan
    
  after_changes:
    - Significant infrastructure changes
    - New system deployments
    
  passing_criteria:
    - No vulnerabilities rated 4.0+ (CVSS)
    - False positives documented
    - Scan completed within 90 days

Common Issues

Issue: False Positives

Problem: Scanner reports non-existent vulnerabilities Solution: Validate manually, tune scanner, maintain exception list

Issue: Incomplete Coverage

Problem: Not all assets scanned Solution: Update asset inventory, verify credentials, check network access

Issue: Scan Impact

Problem: Scans affecting production systems Solution: Schedule during maintenance windows, use authenticated scans

Best Practices

• Maintain accurate asset inventory
• Schedule regular scan cadence
• Validate findings before remediation
• Track metrics (MTTR, aging)
• Integrate with ticketing systems
• Document exceptions properly
• Use risk-based prioritization
• Automate where possible

Related Skills

• sast-scanning - Code analysis
• container-scanning - Container security
• cis-benchmarks - Compliance benchmarks

Vulnerability Remediation Guide

Triage Process

1. Assess Impact

• Is the vulnerability exploitable in your context?
• Is the vulnerable component reachable?
• What's the potential business impact?

2. Prioritize

Priority Matrix:
                    Exploitable
                    Yes         No
Impact  High        P1-Critical P2-High
        Medium      P2-High     P3-Medium
        Low         P3-Medium   P4-Low

3. Remediation Options

Common Remediation Steps

Container Base Images

# Before: Vulnerable base
FROM ubuntu:20.04

# After: Updated base
FROM ubuntu:22.04

# Better: Minimal base
FROM gcr.io/distroless/base-debian12

JavaScript Dependencies

# View outdated packages
npm outdated

# Update specific package
npm update lodash

# Update all (careful!)
npm update

# Force resolution
npm audit fix --force

# Check for updates
npx npm-check-updates

Python Dependencies

# Update specific package
pip install --upgrade requests

# Update with constraints
pip install 'requests>=2.28.0,<3.0.0'

# Using pip-tools
pip-compile --upgrade requirements.in

Terraform Providers

# Pin to secure version
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"  # Update to latest minor
    }
  }
}

False Positive Handling

Trivy Ignore

# .trivyignore
CVE-2022-12345  # Reason: Not exploitable in our context
CVE-2022-67890  # Reason: Component not exposed

Grype Ignore

# .grype.yaml
ignore:
  - vulnerability: CVE-2022-12345
    reason: "Not applicable - component not used"

Documentation Template

## Vulnerability Assessment: CVE-XXXX-XXXXX

**Severity:** High (CVSS 7.5)
**Component:** package-name v1.2.3
**Status:** [Remediated/Accepted/Pending]

### Description
Brief description of the vulnerability.

### Impact Assessment
- Exploitability in our environment: [Yes/No/Partial]
- Affected systems: [List systems]
- Business impact: [Description]

### Remediation
- Action taken: Upgraded to v1.2.4
- Date: YYYY-MM-DD
- Verified by: [Name]

### If Accepted
- Reason for acceptance:
- Compensating controls:
- Review date:
- Approved by:

Vulnerability Scanner Comparison

Container Image Scanners

Recommended: Trivy

Installation

# Homebrew
brew install trivy

# APT
apt-get install trivy

# Docker
docker run aquasec/trivy image nginx:latest

Basic Usage

# Scan image
trivy image nginx:latest

# Scan with severity filter
trivy image --severity HIGH,CRITICAL nginx:latest

# Scan and fail on vulnerabilities
trivy image --exit-code 1 --severity CRITICAL nginx:latest

# JSON output
trivy image -f json -o results.json nginx:latest

# Scan filesystem
trivy fs /path/to/project

# Scan Kubernetes
trivy k8s --report summary cluster

GitHub Actions

- name: Run Trivy vulnerability scanner
  uses: aquasecurity/trivy-action@master
  with:
    image-ref: 'myapp:${{ github.sha }}'
    format: 'sarif'
    output: 'trivy-results.sarif'
    severity: 'CRITICAL,HIGH'
    
- name: Upload Trivy scan results
  uses: github/codeql-action/upload-sarif@v2
  with:
    sarif_file: 'trivy-results.sarif'

Dependency Scanners

Infrastructure as Code Scanners

CVSS Score Reference