Vulnerability Scanning

Scanning MED v1.0.0 updated 2026-06-17

Run automated vulnerability scanners against discovered services to identify known CVEs, misconfigurations, and common security weaknesses at scale.

Tools

Machine-readable JSON available at:

https://reconatlas.pages.dev/api/checklists/vulnerability-scanning

// checklist steps

vulnscan-01

Run Nuclei template scans

Execute Nuclei with community and custom templates against all discovered hosts to detect known vulnerabilities, exposures, and misconfigurations.

nuclei -l live-hosts.txt -t cves/ -o nuclei-cves.txt -rl 50 -c 10
nuclei -l live-hosts.txt -t misconfiguration/ -o nuclei-misconfig.txt
nuclei -l live-hosts.txt -t exposures/ -o nuclei-exposures.txt
nuclei -update-templates

Always update templates before scanning. Use rate limiting (-rl) to avoid overwhelming targets and getting blocked. Review results manually — Nuclei templates can produce false positives.

vulnscan-02

Perform network vulnerability scanning

Run comprehensive network vulnerability scans using Nessus or OpenVAS to identify missing patches, weak configurations, and exploitable services.

omp -u admin -w admin --xml '<create_task><name>target-scan</name><config id="daba56c8-73ec-11df-a475-002264764cea"/><target id="TARGET_ID"/></create_task>'
nmap -sV --script vuln -iL scope-ips.txt -oA nmap-vuln-scan

Schedule heavy network scans during off-peak hours to minimise impact on production services. Nessus and OpenVAS scans generate significant traffic and may trigger alerts.

vulnscan-03

Correlate CVEs with service versions

Match discovered service versions from banner grabbing and fingerprinting against known CVE databases to identify exploitable vulnerabilities.

searchsploit apache 2.4.49
nmap -sV -p 80,443,8080,8443 target.com --script vulners -oA version-vulns
curl -s 'https://services.nvd.nist.gov/rest/json/cves/2.0?keywordSearch=apache+2.4.49' | jq '.vulnerabilities[].cve | {id, descriptions}'

Automated CVE correlation can produce many false positives. Verify that the detected version is genuinely vulnerable and that the specific vulnerable feature is enabled before reporting.

vulnscan-04

Analyse SSL/TLS configuration

Test SSL/TLS implementations for weak ciphers, expired certificates, protocol downgrade vulnerabilities, and certificate chain issues.

testssl.sh --html --csvfile testssl-results.csv https://target.com
sslyze target.com --regular --json_out sslyze-results.json
nmap --script ssl-enum-ciphers -p 443 target.com

Focus on findings that have real security impact — SSLv3/TLS 1.0 support, weak ciphers (RC4, DES), missing HSTS headers, and certificate validity issues. Many programmes do not accept informational SSL findings.

vulnscan-05

Check for default credentials

Test discovered services for default, factory, or commonly used credentials that were never changed after deployment.

nmap --script http-default-accounts -p 80,443,8080,8443 target.com
hydra -L default-users.txt -P default-passes.txt target.com http-get /admin/
nuclei -l live-hosts.txt -t default-logins/ -o default-creds.txt

Only test default credentials, not password brute-forcing, unless explicitly permitted. Common targets include Tomcat Manager, Jenkins, phpMyAdmin, and router admin panels. Always check the programme rules for credential testing restrictions.

vulnscan-06

Detect common misconfigurations

Scan for server and application misconfigurations including directory listing, debug modes, exposed admin panels, and information disclosure.

nuclei -l live-hosts.txt -t misconfiguration/ -t exposed-panels/ -o misconfig-results.txt
nikto -h https://target.com -o nikto-results.html -Format html
nmap --script http-config-backup,http-php-version -p 80,443 target.com

Misconfigurations are often low-hanging fruit in bug bounty programmes. Directory listing on sensitive paths, enabled debug modes, and exposed .git directories are all common findings that programmes readily accept.

Overview

Vulnerability scanning bridges the gap between reconnaissance and manual exploitation. Automated scanners can quickly surface known CVEs, misconfigurations, and common weaknesses across hundreds of hosts — findings that would take days to discover manually.

However, scanners are only as good as your target list and your ability to triage results. Feed them clean, deduplicated input from your reconnaissance phase, and plan to manually verify every finding before reporting. False positives erode trust with programme triagers.

What to look for

Prioritise scanner results by severity and exploitability:

Critical and high CVEs with public exploits
Exposed admin panels with default credentials
SSL/TLS misconfigurations on customer-facing services
Directory listing or source code exposure
Debug endpoints and stack traces leaking internal details

Triage and validation

Never submit a raw scanner finding without manual verification. Confirm the vulnerability exists, assess its actual impact in the target’s context, and document clear reproduction steps. A well-triaged medium finding is worth more than a dozen unverified critical alerts.

// references

← All checklists JSON ↗