System Hacking Phases and Attack Techniques · Topic 1 of 6
Vulnerability Assessment
Learn vulnerability assessment for CEH: life cycle, CVSS scores, CVE and CWE, classification, assessment types, scanners such as Nessus and reports.
- 5 min
- Assessment finds and ranks, while penetration testing exploits.
- CVSS ranges from 0.0 to 10.0, with Critical at 9.0 and above.
- Base, temporal and environmental are the CVSS metric groups.
What it is
A vulnerability is a weakness in a system, application, process or person that a threat could exploit. Vulnerability assessment is the process of finding, classifying, ranking and reporting those weaknesses so they can be fixed.
An assessment finds and ranks weaknesses. It does not try to exploit them, which is what separates it from a penetration test.
How it works
Concepts and life cycle
Vulnerabilities arise from misconfiguration, default settings, unpatched software, design flaws, poor input handling, weak authentication and human error. A vulnerability assessment is repeated, because new flaws appear continuously.
The life cycle has these steps.
| Step | Purpose |
|---|---|
| Create a baseline | Identify assets, their value and normal state |
| Vulnerability assessment | Scan and analyze to find weaknesses |
| Risk assessment | Rank by severity, exposure and business impact |
| Remediation | Patch, reconfigure or accept the risk |
| Verification | Confirm that fixes work, usually by scanning again |
| Monitoring | Watch for new weaknesses and changes |
Ranking and naming vulnerabilities
| System | What it provides |
|---|---|
| CVE | A unique identifier for a publicly known vulnerability, such as CVE-2021-44228 |
| CWE | A catalog of weakness types, such as improper input validation |
| NVD | The United States National Vulnerability Database, which adds scores and details to CVE entries |
| CVSS | The Common Vulnerability Scoring System, a score from 0.0 to 10.0 |
CVSS has three metric groups: base (the intrinsic qualities), temporal (change over time such as exploit availability and fix status) and environmental (the importance in the organization's setting). The qualitative ratings are:
| Score | Severity |
|---|---|
| 0.0 | None |
| 0.1 to 3.9 | Low |
| 4.0 to 6.9 | Medium |
| 7.0 to 8.9 | High |
| 9.0 to 10.0 | Critical |
The Exploit Prediction Scoring System (EPSS) and the CISA Known Exploited Vulnerabilities list help to prioritize by how likely a flaw is to be attacked.
Classification
Vulnerabilities are grouped by origin.
- Misconfiguration, such as open shares or default accounts.
- Default installations and default passwords.
- Buffer overflows and other memory errors.
- Unpatched servers and operating system flaws.
- Design flaws in protocols or applications.
- Open services and unneeded ports.
- Weaknesses in third party components.
Assessment types
| Type | Description |
|---|---|
| Active | Sends probes to the targets to find weaknesses |
| Passive | Observes network traffic without sending probes |
| External | Tests from outside the network, as an attacker would |
| Internal | Tests from inside the network |
| Host-based | Checks one system, often with an agent or credentials |
| Network-based | Looks for network services and devices |
| Application | Tests software and web applications |
| Database | Tests database configuration and access |
| Wireless | Tests wireless networks |
| Credentialed | Logs in to the target for deeper checks |
| Non-credentialed | Tests without logging in |
Two older approaches are product-based (software installed inside the network) and service-based (offered by a third party). The tree-based approach selects a different test per machine, while the inference-based approach builds a list of tests from what it discovers.
Tools
| Tool | Type |
|---|---|
| Nessus | Commercial vulnerability scanner with plug-in checks |
| OpenVAS (Greenbone) | Open-source scanner |
| Qualys | Cloud-based scanning platform |
| Nexpose (Rapid7) | Scanner that rates risk |
| Nikto | Open-source web server scanner |
| Nmap with NSE scripts | Port scanner with vulnerability checks |
| Burp Suite and OWASP ZAP | Web application testing |
| Retina and GFI LanGuard | Other commercial scanners |
Scanners produce false positives (a reported weakness that does not exist) and false negatives (a real weakness that is missed). Credentialed scans reduce false positives.
Reports
A report turns raw results into action. Good reports include:
- Scan details: date, scope, tool and settings.
- Target information: hosts, operating systems and roles.
- For each finding: name, identifier, CVSS score, severity, description, affected systems and evidence.
- Remediation advice and references.
- Executive summary with overall risk and priorities.
Findings are sorted by severity and by business impact, not simply by score.
A worked example
A scanner reports 400 findings on a server farm. After validation, 60 remain relevant. Using CVSS and the importance of each host, the team puts internet-facing hosts with critical scores first. Two weeks later, a verification scan confirms that the critical items are closed.
How the exam asks about this
- "Which score range is rated Critical in CVSS?" -> 9.0 to 10.0.
- "Which identifier uniquely names a known vulnerability?" -> CVE.
- "A scan reports a weakness that does not exist. What is this?" -> A false positive.
What to remember for the exam
- Assessment finds and ranks, while penetration testing exploits.
- CVSS ranges from 0.0 to 10.0, with Critical at 9.0 and above.
- Base, temporal and environmental are the CVSS metric groups.
- Nessus, OpenVAS, Qualys and Nikto are standard scanners.
- Verification by rescan follows remediation.
CVE names a specific vulnerability, while CWE names a type of weakness. They are not interchangeable.
Common mistakes
Treating the CVSS base score as the full risk. Context, exposure and exploit availability change the priority.
Trusting every scanner result. Findings need validation to remove false positives.
Skipping verification. A fix is not proven until a rescan or test confirms it.
Check yourself
What does a CVSS score of 7.5 mean?
It is rated High, since 7.0 to 8.9 falls in that band.
What is the difference between CVE and CWE?
CVE identifies a specific known vulnerability, and CWE classifies the type of weakness.
Why do credentialed scans help?
They log in to the system for deeper checks, which finds more issues and reduces false positives.
Topic 1 of 6 in System Hacking Phases and Attack Techniques
Test yourself on System Hacking Phases and Attack Techniques
The full EC-Council 312-50 question bank has 1,000 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.