Editing Vulnerability Analysis

== Vulnerability Analysis ==

Vulnerability analysis identifies weaknesses in software, services, and configurations before an adversary exploits them. The process blends automated scanning with manual verification and references public knowledge bases for accurate risk assessment.

== Automated Scanning ==

Automated scanners provide rapid coverage of large attack surfaces and deliver structured reports.

=== Common Techniques ===

* Service version detection through banner parsing and protocol negotiation
* CVE mapping based on software fingerprints and patch levels
* Authenticated configuration checks via SSH, WinRM, or API tokens
* Web vulnerability signatures (XSS, SQLi, LFI, SSRF) matched by pattern engines
* Policy compliance tests against CIS or DISA benchmarks
* Continuous integration hooks that scan each code push or image build
=== Tools ===

* [[Nessus]] (commercial vulnerability scanner with extensive plugin library)
* [[OpenVAS]] / [[Greenbone]] (open-source scanner aligned with CVE feeds)
* [[Nuclei]] (YAML-based fast scanner driven by community templates)
* [[Qualys VMDR]] (cloud platform for large-scale asset and patch management)
* [[Nikto]] (web server vulnerability discovery)
* [[WPScan]] (WordPress-specific scanner)
* [[Trivy]] (container image scanner for OS packages and SBOM data)
* [[Clair]] (static container image analysis)
=== Vulnerability Databases & References ===

* [https://www.exploit-db.com exploit-db.com] (archived exploits and shellcode mapped to CVEs)
* [https://nvd.nist.gov NVD] (official National Vulnerability Database with CVSS scoring)
* [https://cve.mitre.org CVE List] (unique identifiers for publicly disclosed vulnerabilities)
* [https://packetstormsecurity.com Packet Storm] (daily advisories, exploit code, and patches)
* [https://vulners.com Vulners] (aggregated search across exploits, advisories, and vendor bulletins)
* [https://cvedetails.com CVE Details] (searchable CVE catalog with vendor and product statistics)
== Manual Verification ==

Manual techniques validate scanner findings, uncover logic flaws, and craft reliable proof-of-concept exploits.

=== Common Techniques ===

* Fuzzing input parameters to trigger crashes or unexpected responses
* Reviewing source code or binaries for unsafe functions and insecure patterns
* Replaying network flows in intercepting proxies to manipulate hidden fields
* Debugging binaries with breakpoints to observe memory handling
* Static disassembly to trace vulnerable instruction sequences
* Patch diffing to spot silently fixed weaknesses
* Proof-of-concept compilation to confirm exploitability and impact
=== Tools ===

* [[Burp Suite]] (intercepting proxy for web application testing)
* [[ZAP]] (OWASP Zed Attack Proxy with active and passive scanners)
* [[Metasploit]] (framework that aligns exploits, payloads, and post modules)
* [[Ghidra]] (static disassembler and decompiler)
* [[IDA Pro]] (interactive disassembler with scripting)
* [[pwntools]] (Python framework for exploit development)
* [[radare2]] (reverse-engineering toolkit with extensive analysis capabilities)
* [[AFL]] / [[libFuzzer]] (coverage-guided fuzzers for binaries and libraries)
* [[gdb]] with [[gef]] or [[pwndbg]] (enhanced debugging for binary exploitation)
== Patch & Mitigation Analysis ==

After validation, vulnerability analysis transitions to remediation guidance and residual-risk measurement.

=== Common Techniques ===

* Comparing vulnerable and patched binaries to verify fix completeness
* Evaluating vendor advisories for configuration workarounds
* Prioritizing patches by CVSS, exploit availability, and business impact
* Mapping mitigations to defense-in-depth layers (WAF rules, segmentation, hardening)
* Testing patches in staging environments for functional stability
=== Tools ===

* [[Diffoscope]] (recursive binary and archive comparison)
* [[Syft]] + [[Grype]] (software-bill-of-materials creation and matching against vulns)
* [[Chef InSpec]] / [[Ansible Lint]] (policy-as-code verification of hardening tasks)
* [[Sysinternals Suite]] (Windows remediation validation)
* [[Kube-Bench]] (CIS benchmark compliance for Kubernetes clusters)
Vulnerability analysis creates a clear view of exploitable weaknesses, guides patch priorities, and feeds continuous improvement cycles across development, operations, and security teams.