Network Reconnaissance

Port scanning reveals what doors exist. Network mapping shows how those doors connect. Vulnerability scanning determines which doors have weak locks—or no locks at all.

Vulnerability scanning is the systematic process of probing discovered services for known security weaknesses. Unlike manual security testing or penetration testing, vulnerability scanning is largely automated—scanners maintain massive databases of known vulnerabilities and check each target against this knowledge base.

This page explores the methodology, tools, and interpretation of vulnerability scanning, examining both offensive use (identifying attack vectors) and defensive use (proactive security assessment). Understanding vulnerability scanning is essential whether you're identifying weaknesses in your own infrastructure or thinking like an attacker to better defend against them.

Vulnerability scanning is an automated security testing technique that systematically examines computer systems, networks, and applications to identify security weaknesses that could be exploited by attackers.

How it differs from other reconnaissance:

The core principle:

Vulnerability scanners maintain extensive databases of:

• Known software vulnerabilities (CVEs)
• Default/weak configurations
• Missing security patches
• Misconfigurations that create security risks

When scanning a target, the scanner:

1. Identifies the software/version running
2. Queries its database for known vulnerabilities affecting that version
3. Attempts to verify the vulnerability exists (to varying degrees)
4. Reports findings with severity ratings and remediation guidance

Vulnerability scans vary dramatically in approach, depth, and intrusiveness. Understanding these variations is essential for selecting the right technique and interpreting results accurately.

Modern vulnerability scanners are complex systems with multiple components working together to identify, verify, and report vulnerabilities.

Core components:

The plugin architecture:

Vulnerability scanners use a plugin (or script) system where each check is an independent module:

Plugin: CVE-2021-44228 (Log4Shell)
├── Affected: Log4j 2.0-beta9 to 2.14.1
├── Detection: Send JNDI lookup string, monitor callback
├── Severity: CVSS 10.0 (Critical)
├── Verification: Active callback confirms vulnerability
└── Remediation: Upgrade to 2.17.0+

Major scanners have 100,000+ plugins covering decades of vulnerabilities. Plugins are updated constantly as new CVEs are published—typically within 24-48 hours of public disclosure.

Commercial scanners (Tenable Nessus, Qualys, Rapid7 Nexpose) employ security researchers who create and maintain these plugins.

Open-source scanners (OpenVAS, Nuclei) rely on community contributions and may lag in coverage.

The vulnerability scanning market includes both commercial enterprise solutions and powerful open-source alternatives. Understanding their differences helps in selecting the right tool.

Effective vulnerability scanning follows a structured methodology. Random scanning without planning produces overwhelming, unactionable results.

The scanning process:

Scan policy considerations:

Vulnerability scanners report severity using the Common Vulnerability Scoring System (CVSS)—an industry-standard framework for rating vulnerability severity.

CVSS v3.1 Score Ranges:

CVSS score components:

CVSS scores are calculated from multiple factors:

Base Score (intrinsic characteristics):

• Attack Vector (AV): Network, Adjacent, Local, Physical
• Attack Complexity (AC): Low, High
• Privileges Required (PR): None, Low, High
• User Interaction (UI): None, Required
• Scope (S): Unchanged, Changed
• Impact (C/I/A): Confidentiality, Integrity, Availability impacts

Example: Log4Shell (CVE-2021-44228) Score Breakdown:

AV:N    (Network - attackable over internet)
AC:L    (Low complexity - easy to exploit)
PR:N    (No privileges needed)
UI:N    (No user interaction required)
S:C     (Scope changed - affects other components)
C:H/I:H/A:H (High impact on all three)

Result: CVSS 10.0 (Maximum severity)

Vulnerability scanners are imperfect. They produce false positives (reporting vulnerabilities that don't exist) and false negatives (missing vulnerabilities that do exist). Understanding these limitations is essential for effective scanning.

Why false positives occur:

Verification strategies:

1. Manual exploitation testing:

   • Use Metasploit or manual techniques to verify exploitability
   • Time-consuming but definitive

2. Patch verification:

   • Check installed patches directly (requires system access)
   • Compare with vendor's security bulletin

3. Configuration review:

   • Verify if reported configuration weakness actually exists
   • Check if compensating controls mitigate the issue

4. Vendor advisories:

   • Cross-reference with vendor's security advisories
   • Verify affected version ranges

A comprehensive vulnerability scan might return thousands of findings. Fixing everything immediately is impossible—prioritization is essential.

Risk-based prioritization framework:

Prioritization formula:

Priority Score = (Severity × Exploitability × Exposure × Asset Value) 
                 / Compensating Controls

Example prioritization:

Point-in-time scans are insufficient. New vulnerabilities are discovered daily, systems change constantly, and attack surfaces evolve. Modern security programs implement continuous vulnerability scanning.

Continuous scanning models:

Modern continuous scanning approach:

1. Asset discovery runs continuously — New systems detected within hours
2. Agent-based scanning — Endpoints report status regardless of network location
3. Event-triggered scanning — New deployments trigger immediate scan
4. Differential scanning — Only check what changed since last scan
5. Threat intelligence integration — Prioritize scanning when new threats emerge

Integration points:

• CI/CD pipelines: Scan images before deployment
• Cloud APIs: Auto-discover and scan new cloud resources
• SIEM/SOAR: Correlate vulnerabilities with security events
• ITSM: Auto-create tickets for new findings
• Configuration management: Verify expected vs. actual state

Vulnerability scanning is the bridge between reconnaissance and exploitation—it identifies which discovered services have exploitable weaknesses. Let's consolidate the key concepts:

What's next:

Vulnerability scanning identifies what's vulnerable. But comprehensive reconnaissance also gathers intelligence from many other sources. The next page covers Information Gathering—the broader OSINT techniques that supplement technical scanning.