Vulnerability Research and Prioritization
Turn discovered services into exploitable flaws: CVE and NVD databases, CVSS scores, automated scanners, and risk prioritization.
4 hrs/week
🟩 Reconnaissance · Cycle: 3. Vulnerability Analysis HTB Academy: Vulnerability Assessment
Objectives
- Identify and prioritize flaws based on the services discovered in W4.
- Work with CVE/NVD, CVSS, and scanners.
Vulnerability assessment vs. penetration testing
A vulnerability assessment consists of identifying and listing the flaws in a system, often with automated scanners, without necessarily exploiting them. A penetration test goes further: it actually exploits the flaws to demonstrate their impact. This week, we focus on identification and prioritization; exploitation begins in W6/W7. Prioritizing well keeps you from wasting time on minor flaws.
Lecture (1 h 20)
- Vulnerability lifecycle; 0-day vs. n-day.
- CVSS (severity score), CVE (identifier), CWE (weakness type).
- False positives, risk-based prioritization (severity × exposure × business impact).
CVE, CVSS, CWE: three acronyms not to be confused
- CVE (Common Vulnerabilities and Exposures): a unique identifier for a specific flaw in a specific product, e.g.
CVE-2021-41773(an Apache flaw). It's like a global case number. - CVSS (Common Vulnerability Scoring System): a severity score from 0.0 to 10.0. Roughly: 0–3.9 low, 4–6.9 medium, 7–8.9 high, 9–10 critical. The score is calculated from a "vector" (ease of exploitation, impact, etc.).
- CWE (Common Weakness Enumeration): the type of underlying weakness, e.g.
CWE-89= SQL injection. A CVE is a concrete instance; a CWE is the general category.