{
  "slug": "vulnerability-scanning",
  "title": "Vulnerability Scanning",
  "phase": "Scanning",
  "description": "Run automated vulnerability scanners against discovered services to identify known CVEs, misconfigurations, and common security weaknesses at scale.",
  "difficulty": "medium",
  "tags": [
    "scanning",
    "vulnerability-assessment",
    "cve",
    "misconfiguration",
    "automated"
  ],
  "tools": [
    "nuclei",
    "Nessus",
    "OpenVAS",
    "testssl.sh",
    "sslyze"
  ],
  "steps": [
    {
      "id": "vulnscan-01",
      "title": "Run Nuclei template scans",
      "description": "Execute Nuclei with community and custom templates against all discovered hosts to detect known vulnerabilities, exposures, and misconfigurations.",
      "commands": [
        "nuclei -l live-hosts.txt -t cves/ -o nuclei-cves.txt -rl 50 -c 10",
        "nuclei -l live-hosts.txt -t misconfiguration/ -o nuclei-misconfig.txt",
        "nuclei -l live-hosts.txt -t exposures/ -o nuclei-exposures.txt",
        "nuclei -update-templates"
      ],
      "notes": "Always update templates before scanning. Use rate limiting (-rl) to avoid overwhelming targets and getting blocked. Review results manually — Nuclei templates can produce false positives."
    },
    {
      "id": "vulnscan-02",
      "title": "Perform network vulnerability scanning",
      "description": "Run comprehensive network vulnerability scans using Nessus or OpenVAS to identify missing patches, weak configurations, and exploitable services.",
      "commands": [
        "omp -u admin -w admin --xml '<create_task><name>target-scan</name><config id=\"daba56c8-73ec-11df-a475-002264764cea\"/><target id=\"TARGET_ID\"/></create_task>'",
        "nmap -sV --script vuln -iL scope-ips.txt -oA nmap-vuln-scan"
      ],
      "notes": "Schedule heavy network scans during off-peak hours to minimise impact on production services. Nessus and OpenVAS scans generate significant traffic and may trigger alerts."
    },
    {
      "id": "vulnscan-03",
      "title": "Correlate CVEs with service versions",
      "description": "Match discovered service versions from banner grabbing and fingerprinting against known CVE databases to identify exploitable vulnerabilities.",
      "commands": [
        "searchsploit apache 2.4.49",
        "nmap -sV -p 80,443,8080,8443 target.com --script vulners -oA version-vulns",
        "curl -s 'https://services.nvd.nist.gov/rest/json/cves/2.0?keywordSearch=apache+2.4.49' | jq '.vulnerabilities[].cve | {id, descriptions}'"
      ],
      "notes": "Automated CVE correlation can produce many false positives. Verify that the detected version is genuinely vulnerable and that the specific vulnerable feature is enabled before reporting."
    },
    {
      "id": "vulnscan-04",
      "title": "Analyse SSL/TLS configuration",
      "description": "Test SSL/TLS implementations for weak ciphers, expired certificates, protocol downgrade vulnerabilities, and certificate chain issues.",
      "commands": [
        "testssl.sh --html --csvfile testssl-results.csv https://target.com",
        "sslyze target.com --regular --json_out sslyze-results.json",
        "nmap --script ssl-enum-ciphers -p 443 target.com"
      ],
      "notes": "Focus on findings that have real security impact — SSLv3/TLS 1.0 support, weak ciphers (RC4, DES), missing HSTS headers, and certificate validity issues. Many programmes do not accept informational SSL findings."
    },
    {
      "id": "vulnscan-05",
      "title": "Check for default credentials",
      "description": "Test discovered services for default, factory, or commonly used credentials that were never changed after deployment.",
      "commands": [
        "nmap --script http-default-accounts -p 80,443,8080,8443 target.com",
        "hydra -L default-users.txt -P default-passes.txt target.com http-get /admin/",
        "nuclei -l live-hosts.txt -t default-logins/ -o default-creds.txt"
      ],
      "notes": "Only test default credentials, not password brute-forcing, unless explicitly permitted. Common targets include Tomcat Manager, Jenkins, phpMyAdmin, and router admin panels. Always check the programme rules for credential testing restrictions."
    },
    {
      "id": "vulnscan-06",
      "title": "Detect common misconfigurations",
      "description": "Scan for server and application misconfigurations including directory listing, debug modes, exposed admin panels, and information disclosure.",
      "commands": [
        "nuclei -l live-hosts.txt -t misconfiguration/ -t exposed-panels/ -o misconfig-results.txt",
        "nikto -h https://target.com -o nikto-results.html -Format html",
        "nmap --script http-config-backup,http-php-version -p 80,443 target.com"
      ],
      "notes": "Misconfigurations are often low-hanging fruit in bug bounty programmes. Directory listing on sensitive paths, enabled debug modes, and exposed .git directories are all common findings that programmes readily accept."
    }
  ],
  "references": [
    "https://github.com/projectdiscovery/nuclei",
    "https://github.com/drwetter/testssl.sh",
    "https://github.com/nabla-c0d3/sslyze",
    "https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/02-Configuration_and_Deployment_Management_Testing/",
    "https://portswigger.net/web-security"
  ],
  "version": "1.0.0",
  "updatedAt": "2026-06-17"
}