DB.
Courses

Vulnerability Scanning
OSCP · Chapter 4

Vulnerability Scanning

Vulnerability scanning automates the tedious first pass of matching service versions and configurations to known weaknesses. It is a starting point for investigation, not a substitute for manual verification — scanners produce false positives and miss business-logic flaws entirely.

Key concepts

  • Nmap with the `-sV --script vuln` NSE category gives a fast first pass of likely issues per open port.
  • Dedicated scanners (Nessus, OpenVAS) are stronger for large host counts, but still require manual triage of every "critical" finding.
  • Always validate scanner output manually — an unauthenticated scan cannot tell you if a "vulnerable" version is actually reachable or patched via a backport.
  • Rate-limit and schedule scans in real engagements; an aggressive scan can crash fragile legacy services in production.

Example

nmap -sV -p- --script vuln 10.10.10.5 -oA vulnscan

Try it yourself

Run an Nmap version-detection scan against a lab VM (e.g. Metasploitable) and manually confirm one flagged vulnerability actually exists by checking the service version against a CVE database.

ReferenceSearch video walkthroughs

@ Daniel Burlacu