Domain 4 of 4 · Chapter 2 of 4

Analyze vulnerability assessment output

Unlock the complete study guide.

Bundled into the existing CompTIA CySA+ premium course — no separate purchase.

14-day money-back guarantee — no questions asked.

Included in this chapter:

  • Evidence types in assessment output
  • Reconnaissance leads: Recon-ng and Maltego
  • Host and port results: Angry IP Scanner, Masscan, Nmap
  • Service and operating-system identification
  • Vulnerability scanner findings: Nessus, OpenVAS, Nuclei
  • Comparing severity labels across tools
  • What a clean report does not prove
  • Web assessment tools: Burp Suite, ZAP, Nikto
  • Classifying web application findings
  • Cloud, IaC and container assessment tools
  • Matching cloud and container findings to corrections
  • Exploitability evidence: Metasploit Framework
  • Breach and attack simulation: Atomic Red Team and CALDERA
  • Misreadings of assessment output, by evidence type

Assessment tool categories and the evidence type each produces

Tool categoryNamed toolsEvidence type producedWhat the output cannot prove alone
Network scanning and mappingAngry IP Scanner, MasscanIdentification evidence (responding hosts, open ports)That any listening service is vulnerable
Multipurpose toolsNmap; Recon-ng, Maltego; Metasploit FrameworkNmap: identification evidence (network discovery); Recon-ng and Maltego: reconnaissance leads (open-source intelligence, OSINT); Metasploit Framework: exploitability evidence (penetration testing)A vulnerability from port identification alone; a tested weakness from a reconnaissance lead
Web application scannersBurp Suite, Zed Attack Proxy (ZAP), NiktoVulnerability evidence about web servers and running web applicationsThat business-logic abuse of the application's workflow is absent
Vulnerability scannersNessus, Nuclei, OpenVASVulnerability evidence from remote checks and local, authenticated (credentialed) checks (Nessus), unauthenticated (non-credentialed) and authenticated (credentialed) tests (OpenVAS) or templates that define checks (Nuclei)Absence of a weakness: scanners have high false negative rates (vulnerabilities the assessment fails to report), and less comprehensive scans identify only well-known vulnerabilities
Cloud infrastructure assessment toolsScoutSuite, Prowler, Trivy, CheckovVulnerability evidence about cloud accounts, IaC definitions, images and secretsLive state from a definition-only (IaC) check; host kernel safety from an image scan
Breach and attack simulation (BAS) toolsAtomic Red Team, CALDERADefensive evidence, once each test result (executed or blocked) is matched to telemetry and alerts, with a blocked result also checked against the control's own recordDetection from a completed task alone; detection of other procedures for the same technique

Decision tree

About your own controls?YesDefensive evidenceTest result matched to telemetry,alerts and the control's own recordNoMust exploitation be shown?YesExploitability evidenceAuthorized exploitation attemptNoMust a weakness be shown?YesVulnerability evidenceA weakness on a specific targetNoPublic records or live hosts?Public recordsLive hostsReconnaissance leadPublic recordsIdentification evidenceHosts, ports, services
Cheat sheet

Cheat sheet

  • An open service becomes a policy finding when its exposure violates requirements
  • A port-based service label is weaker evidence than a service response
  • Filtering prevents a definitive conclusion about the underlying service
  • Device fingerprints are inferences that require corroboration when evidence conflicts
  • A reachable host or open port is not proof of an exploitable vulnerability
  • Nmap can identify the service behind a discovered port
  • Recon-ng supplies reconnaissance leads from public information
  • Metasploit Framework can provide exploitability evidence during authorized assessments
  • Authentication failure reduces confidence in local vulnerability coverage
  • Scanner detection content must cover the vulnerabilities being assessed
  • A clean report applies only to the checks and targets actually assessed
  • Scanner severity labels must be interpreted using their stated scoring basis
  • A service banner can differ from the installed software version
  • Nessus can report both remote and authenticated local security checks
  • Nuclei findings depend on the templates used for the assessment
  • OpenVAS performs vulnerability tests rather than just network discovery
  • Validate SQL injection findings using evidence of unintended database query interpretation
  • Cross-site scripting requires attacker-controlled content to reach an executable browser context
  • Access to files outside the intended directory indicates path traversal
  • Another user's accessible object indicates an authorization weakness
  • Automated web scanning does not replace application-specific business-logic testing
  • Nikto findings focus on web-server weaknesses
  • Burp Suite brings HTTP inspection into an integrated application-testing platform
  • ZAP is an open-source choice for dynamic web application assessment
  • Validate command injection findings by identifying the affected execution context
  • An infrastructure-code finding describes a definition rather than proving live deployment state
  • Container image vulnerability findings concern software inside the image
  • A clean container image does not establish that the host kernel is safe
  • Excessive cloud permissions are configuration findings rather than missing software patches
  • A secret found in infrastructure code is a credential exposure finding
  • Trivy findings require corrections matched to the artifact and finding type
  • Checkov can identify unsafe infrastructure before deployment
  • ScoutSuite is a multi-cloud security-auditing tool
  • Prowler supports cloud security assessment and compliance validation
  • Breach and attack simulation evaluates defenses against exercised behavior
  • Successful simulation execution and successful detection are separate outcomes
  • One detected procedure does not validate every implementation of a technique
  • Simulation coverage should prioritize threats relevant to the environment
  • Atomic Red Team tests discrete ATT&CK-mapped behaviors
  • A CALDERA emulation plan does not establish defensive detection

Unlock with Premium — includes all practice exams and the complete study guide.

Also tested in

References

  1. https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-115.pdf
  2. https://www.cisa.gov/resources-tools/services/network-mapper
  3. https://wstg.owasp.org/v4.2/4-Web_Application_Security_Testing/02-Configuration_and_Deployment_Management_Testing/10-Test_for_Subdomain_Takeover/
  4. https://www.cisa.gov/resources-tools/services/metasploit-framework
  5. https://owasp.org/www-community/attacks/Blind_SQL_Injection
  6. https://owasp.org/www-community/attacks/xss/
  7. https://owasp.org/Top10/2021/A01_2021-Broken_Access_Control/
  8. https://owasp.org/www-community/attacks/Command_Injection
  9. https://www.cisa.gov/resources-tools/services/atomic-red-team
  10. https://attack.mitre.org/resources/get-started/adversary-emulation-and-red-teaming/
  11. https://attack.mitre.org/techniques/T1046/
  12. https://www.comptia.org/en-us/certifications/cybersecurity-analyst/v4/
  13. https://www.cisa.gov/resources-tools/services/tenable-nessus-essentials
  14. https://www.cisa.gov/resources-tools/services/openvas
  15. https://owasp.org/www-project-asvs-security-evaluation-templates-with-nuclei/
  16. https://www.cisa.gov/resources-tools/services/burp-suite-community-edition
  17. https://community.owasp.org/Free_for_Open_Source_Application_Security_Tools
  18. https://www.cisa.gov/resources-tools/services/nikto
  19. https://owasp.org/www-community/vulnerabilities/Business_logic_vulnerability
  20. https://top10proactive.owasp.org/the-top-10/c5-secure-by-default/
  21. https://www.cisecurity.org/partner/prowler
  22. https://www.cisa.gov/resources-tools/services/checkov
  23. https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html
  24. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-190.pdf
  25. https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html