Vulnerability management: Nikto, Nuclei, Exploit-DB
Scanning, prioritising and the fix cycle.
Level 201 · 16 lessons · 18 practice labs
Lessons
The cycle and its sources
- The vulnerability management cycle: You will understand the vulnerability management cycle of finding, assessing, fixing and verifying, and why each step is needed.
- Asset discovery: knowing what you scan
- Scanning safely: permission, time window, rate
- Looking up known vulnerabilities by version with searchsploit: You learn to look up known vulnerabilities for the software versions on your own systems in public records and pick out which ones apply to you.
- Reading and matching advisories: You learn to read vendor security advisories, match the affected versions against your own inventory, and decide which update is needed.
- Version fingerprinting: service versions with nmap -sV
- Short task: match three service versions to known vulnerabilities
Scanning
- Scanning a web server with Nikto: You learn to scan your own web server with Nikto, with permission, and list findings such as outdated versions and risky settings.
- Scanning with Nuclei templates: You learn to check your own systems for known issues with Nuclei templates and to read what each template actually tests.
- Writing your own Nuclei template
- Interpreting Nikto and Nuclei findings, filtering false positives: You learn to interpret scan findings, filter out false positives, and focus on the real problems.
- Short task: scan a web server and weed out false positives
Prioritising and tracking
- Prioritising: severity, exposure, exploitation: You learn to decide which weakness to fix first by looking at its severity, whether it is reachable from outside, and whether it is actively abused.
- Tracking remediation with Nuclei: You learn to track fixes with an owner and a date, and to confirm closed items by scanning them again.
- Verifying a fix by rescanning
- Capstone: a weekly vulnerability report with Nikto and Nuclei: For a fictional company's lab systems you prioritise the findings and prepare a weekly vulnerability report for management.
Practice labs
- Find a service version with nmap and match it to a flaw: Determine the version with nmap -sV and find the matching entry in searchsploit.
- Find the real version behind a misleading banner: Verify the real version from behaviour and package data instead of the altered banner.
- Read an advisory and work out who is affected: Compare the conditions in the advisory with three servers’ configurations and write down which are affected.
- Write a safe scan plan with permission and time window: Prepare a plan with scope, rate limit and excluded fragile systems and run the scan within those limits.
- Scan a web server with Nikto and choose the top finding: Run the scan, read the findings in the output and choose the one that carries real risk, with reasons.
- Find exposed files with Nuclei templates: Scan for backup and config files with ready templates and verify what is found.
- Write your own Nuclei template: Write a template that catches an internal app’s exposed debug page and try it on two servers.
- Weed out the false positives in scanner findings: Verify each finding by hand, mark the unreal ones with reasons and produce the clean list.
- Find the server this template misses and fix the template: Find the server that does not match because of a redirect and add redirect following and a second matcher.
- Verify a fix by rescanning: Rescan a finding reported as closed and record with evidence that it really is closed.
- Rank findings by severity, exposure and exploitation: Score ten findings on three criteria and choose the three to close this week.
- Diff two scans: Compare last week’s and this week’s results and list closed, still open and new findings.
- Find why a finding marked closed came back: Show a reopened finding was reverted by configuration management and apply the lasting fix.
- Find the fixed version and the workaround in a security advisory: Read a fictional vendor advisory and note the affected version range, the fixed version and the suggested interim mitigation.
- Prove exposure while accounting for a distribution’s backported fix: Examine the changelog of a package whose version looks vulnerable and the distribution’s security tracker, and prove whether the flaw is fixed.
- Find by manual validation the flaw the scanner missed: Manually check the version and configuration of a service the scan reported clean, explain why the scanner could not see the issue and log the finding with evidence.
- Compare the finding counts of two scan reports: Write the counts by severity from last month’s and this month’s reports side by side.
- Write a script reporting a scan diff as new, closed and reopened findings: Match three scans by host, port and finding ID, separate findings that returned after closing and add a check that an unscanned host is not counted as fixed.
About this course
Scanning, prioritising and the fix cycle.
What you will learn
- The cycle and its sources
- Scanning
- Prioritising and tracking
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.