Vulnerability scanning: planning, running and interpreting
You plan a vulnerability scan and set its scope, compare authenticated and unauthenticated scans, weed out false positives, group findings by root cause and rescan after remediation.
Level 201 · 20 lessons · 18 practice labs
Lessons
Planning
- How a vulnerability scanner works: version matching and active checks
- Planning a vulnerability scan and defining its scope
- Scan timing and reducing the risk of disruption
- Informing system owners and the monitoring team
- Short task: write a scan plan for the lab network
Running
- Installing OpenVAS and updating its feeds
- Creating targets and scan configurations
- Unauthenticated scanning: what is visible from outside
- Authenticated scanning: an authorised account for more accurate results
- Keeping the scan account safe: least privilege and a password vault
- Quick configuration checks with Nuclei templates
- Short task: compare an authenticated and an unauthenticated scan
Interpreting
- Reading the scan report: severity, confidence, evidence
- Weeding out false positives: backported patches and version confusion
- What the scanner cannot see: coverage and check limits
- Merging findings and grouping them by root cause
- Short task: triage a fifty-finding report and pull out the first ten jobs
Results
- Exporting results and sharing them with owners
- Rescanning after remediation
- Capstone: scan the lab network, triage, get fixes made and rescan
Practice labs
- Write a one-page scan plan for the lab network: Fill in a scan plan covering scope, time window, excluded systems and the contact person.
- Separate fragile systems in the scan plan: Find outage-sensitive devices in Çamlıbel Su İdaresi's inventory and define a separate low-intensity scan window for them.
- Prepare the scan notice and the back-out rule: Write the notice for system owners and the monitoring team, and define which signs stop the scan.
- Create a target and scan configuration in the scanner: Define the target list and port range for the lab network, start the first scan and record its status.
- Confirm the scanner feeds are up to date: Check the feed dates, update the stale feed, rerun the same scan and note the difference.
- Tune the scan so it never touches out-of-scope hosts: Apply the exclusion list and prove from the scan log that no packets reached out-of-scope addresses.
- Compare a credentialed and an uncredentialed scan: Scan the same server both ways and list findings that appear only in the credentialed scan.
- Set up the scan account with least privilege: Create an account with just enough rights for scanning, restrict where it can log in and confirm the scan still gets full results.
- Detect a scan whose authentication failed silently: Find the authentication warnings in the report, fix why the account failed and confirm with a rescan.
- Run configuration checks with ready-made templates: Run only configuration-category templates against the lab web server and record the findings.
- Narrow a template scan by severity and tag: Run only high and critical configuration templates against Sedirli Hukuk Bürosu's lab site and export the result.
- Write an organisation-specific configuration check template: Write a simple template that detects an exposed admin page, and show it works by testing on an open and then a closed server.
- Read severity, confidence and evidence in a scan report: Extract severity, confidence and evidence for ten findings into a table.
- Weed out a false positive caused by a backported patch: Compare a version-matched finding with the package changelog and prove it is a false alarm.
- Group a fifty-finding report by root cause and pick the top ten tasks: Merge Yakamoz Telekom's scan report, group by root cause and list the top ten fix tasks with owners.
- Export findings per system owner: Export scan results into one file per owner and add a summary line to each.
- Rescan after the fix and mark the closed findings: Fix three findings, rescan with the same configuration and fill the before-and-after table.
- Scan, triage, fix and rescan the lab network: Run the full cycle on Narçiçeği Eczaneleri's lab network and report closed, still-open and false-alarm findings.
About this course
You plan a vulnerability scan and set its scope, compare authenticated and unauthenticated scans, weed out false positives, group findings by root cause and rescan after remediation.
What you will learn
- Planning
- Running
- Interpreting
- Results
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.