Vulnerability Management & Penetration Testing¶
Proactively finding weaknesses before attackers do is core blue-team work.
Vulnerabilities, Exploits & CVEs¶
- Vulnerability — a weakness (e.g., unpatched software).
- Exploit — code/technique that abuses it.
- CVE — a unique ID for a publicly known vulnerability (e.g., CVE-2021-44228, "Log4Shell").
- CVSS — a 0–10 severity score. Useful, but prioritize by exploitability + exposure + business impact, not score alone.
- Zero-day — a vulnerability with no patch available yet.
The Vulnerability Management Lifecycle¶
1. Discover (asset inventory)
2. Scan (Nessus, OpenVAS, Qualys)
3. Prioritize (severity + exposure + exploitability)
4. Remediate (patch, configure, or compensate)
5. Verify (rescan)
6. Report (track trends, SLAs)
↺ repeat continuously
You can't protect what you don't know you have. Asset inventory is the unglamorous foundation of everything.
Prioritization Signals¶
- Is it internet-facing?
- Is there a known exploit in the wild (CISA KEV catalog)?
- Does it touch sensitive data or critical systems?
- What's the compensating control if you can't patch immediately?
Penetration Testing¶
A pentest is an authorized, simulated attack to find exploitable weaknesses.
| Type | Tester knowledge |
|---|
| Black box | None (external attacker view) |
| Grey box | Partial (some access/info) |
| White box | Full (source, architecture) |
Phases¶
- 1.Scoping & Rules of Engagement — written authorization, boundaries, timing. Never skip this.
- 2.Reconnaissance — passive and active info gathering.
- 3.Scanning & enumeration — map services and weaknesses.
- 4.Exploitation — safely prove impact.
- 5.Post-exploitation — assess reach (lateral movement, data access).
- 6.Reporting — findings, risk ratings, remediation guidance.
Related Assessment Types¶
- Vulnerability assessment — breadth (find many issues), no exploitation.
- Penetration test — depth (prove exploitability) within scope.
- Red team — goal-oriented, stealthy, tests detection & response.
- Bug bounty — crowdsourced testing under a defined policy.
- Responsible disclosure — report found flaws to vendors, give time to fix.
The Ethical & Legal Line (again)¶
Authorization is everything. A pentest without written permission is a crime, no matter how good the intentions. Scope, authorize, document — every time.