Vulnerability Discovery and Analysis · Topic 4 of 5
Vulnerability Discovery Tools
Know what Nessus, OpenVAS, Nikto, Nuclei, ZAP, Burp Suite, Trivy and cloud scanners are used for, and how to match each tool to a testing goal.
- 4 min
- Nessus, OpenVAS, Qualys and InsightVM are network and host vulnerability scanners.
- OpenVAS is open source, and Nessus is a commercial product from Tenable.
- Nikto scans web servers for known issues and misconfigurations, and it is noisy.
What it is
Many tools find vulnerabilities, and each has a target: networks, web servers, web applications, containers or cloud accounts. The exam asks you to pick the right tool for a goal, and to know which are scanners and which are proxies or frameworks.
The main skill is matching the tool to the layer being tested.
How it works
Network and host vulnerability scanners
| Tool | Notes |
|---|---|
| Nessus | Commercial scanner from Tenable, with a large plug-in library, credentialed scans and compliance checks. Its web interface is commonly reached on port 8834 |
| OpenVAS | Open-source scanner, now part of the Greenbone Vulnerability Management project, with a regularly updated feed of tests |
| Qualys | Cloud-delivered scanning platform with agents |
| Rapid7 InsightVM | Commercial scanner with reporting and risk scoring |
| Nmap Scripting Engine (NSE) | Scripts inside Nmap, some of which check for specific vulnerabilities |
These tools scan address ranges, identify services, match them with known vulnerabilities and report a severity. They support authenticated scanning and scheduled scans.
Web server and web application tools
| Tool | Purpose |
|---|---|
| Nikto | Open-source web server scanner that checks for dangerous files, outdated server software and common misconfigurations |
| ZAP (Zed Attack Proxy, formerly OWASP ZAP) | Free web application scanner and intercepting proxy |
| Burp Suite | Intercepting proxy and testing suite from PortSwigger, with automated scanning in its professional edition |
| Nuclei | Fast scanner driven by community-maintained templates for specific issues |
| WPScan | Scanner for WordPress sites, plug-ins and themes |
| sqlmap | Tool that tests for database injection flaws |
An intercepting proxy sits between the browser and the server, so the tester can see and change requests. Such tools support manual testing as much as automated scanning.
Nikto is simple to run, and it is noisy, because it sends thousands of requests.
Linux shell (authorised target only):
nikto -h 192.0.2.10 -p 80,443Here -h names the host and -p the ports. Many findings from Nikto are informational and need review.
Container, code and infrastructure tools
| Tool | Purpose |
|---|---|
| Trivy and Grype | Scan container images, file systems and dependencies for known vulnerabilities |
| Docker Bench for Security | Checks container host settings against best practice |
| Checkov and similar | Scan infrastructure as code templates for insecure settings |
| Semgrep, Bandit and similar | Static code analysis for specific languages |
| Gitleaks and TruffleHog | Search repositories for exposed secrets |
Kubernetes and host assessment tools
| Tool | Purpose |
|---|---|
| kube-hunter | Scans a Kubernetes cluster for weaknesses such as an exposed application programming interface (API) server or kubelet |
| PowerSploit | A PowerShell collection used for host reconnaissance and post-exploitation checks during an assessment |
kube-hunter focuses on cluster exposure, while PowerSploit runs on a Windows host the tester has already reached.
Cloud tools
| Tool | Purpose |
|---|---|
| Prowler | Checks cloud accounts, such as Amazon Web Services (AWS), against best practice |
| ScoutSuite | Multi-cloud configuration auditing |
| Pacu | AWS exploitation framework used to test permissions |
| Cloud provider tools | Native posture services that report misconfigurations |
Cloud scanners work through the provider's application programming interface (API), using credentials, and they report on configuration rather than open ports.
Choosing a tool
- Whole network, many hosts: Nessus, OpenVAS, Qualys or InsightVM.
- A web server's default files and configuration: Nikto.
- Application logic, sessions and inputs: ZAP or Burp Suite, with manual testing.
- A known vulnerability across many hosts: Nuclei or an Nmap script.
- Container images before deployment: Trivy or Grype.
- Cloud account misconfiguration: Prowler or ScoutSuite.
No single tool is complete, so testers combine two or three and compare results. A finding reported by two independent tools is more likely to be real.
Scanning tools can disrupt services, so use approved profiles, throttle the speed, and never point a scanner at an address that is not in scope.
What to remember for the exam
- Nessus, OpenVAS, Qualys and InsightVM are network and host vulnerability scanners.
- OpenVAS is open source, and Nessus is a commercial product from Tenable.
- Nikto scans web servers for known issues and misconfigurations, and it is noisy.
- ZAP and Burp Suite are intercepting proxies that also scan web applications.
- Nuclei uses templates, and WPScan targets WordPress.
- Trivy and Grype scan container images, and Prowler and ScoutSuite audit cloud accounts.
- Gitleaks and TruffleHog look for secrets in repositories.
- Always validate tool output, and combine tools for confidence.
Common mistakes
Using a web scanner for a network assessment. Nikto does not inventory network hosts or patch levels.
Treating Burp Suite or ZAP as only scanners. Their main strength is manual work through the proxy.
Running tools with default settings on production. Default intensity may be too high for fragile hosts.
Ignoring cloud configuration. A port scan of cloud hosts misses overly broad permissions or public storage.
Trusting one tool. Each tool has gaps and false positives, so a second source helps.
Check yourself
Which tool is an open-source network vulnerability scanner?
OpenVAS, part of the Greenbone project.
What does Nikto check?
Web servers, for dangerous files, outdated software and common misconfigurations.
Which tools scan container images for known vulnerabilities?
Tools such as Trivy and Grype.
Topic 4 of 5 in Vulnerability Discovery and Analysis
Test yourself on Vulnerability Discovery and Analysis
The full CompTIA PenTest+ PT0-003 question bank has 653 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.