VAPT & OWASP

Module 3: VAPT & OWASP

Section A: Vulnerability Management

Start-Tech Academy
Understanding Vulnerabilities
Understanding vulnerabilities, VAPT, and OWASP standards helps protect systems from cyber
threats.

• Vulnerabilities: Weaknesses in software, hardware, or networks that attackers exploit for

unauthorized access, service disruption, or data theft.

• Vulnerability Assessment and Penetration Testing (VAPT):

Vulnerability Assessment: Identifies and prioritizes potential weaknesses.

• Penetration Testing: Attempts to exploit those vulnerabilities, simulating real-world attacks.

• OWASP (Open Web Application Security Project): Non-profit providing guidelines, tools, and
resources for web security.

Start-Tech Academy
Memory Injections & Buffer Overflow
• Memory Injection: Injects malicious code or data into a program's memory, causing it to
execute unintended commands. Can lead to privilege escalation or system control.

• Buffer Overflow: Occurs when excess data is written to a memory buffer, overflowing into
adjacent memory. This can overwrite critical data, leading to system crashes or execution of
malicious code.

Both vulnerabilities result from poor memory management in software and are commonly
exploited for unauthorized access or privilege escalation in sophisticated attacks.

Start-Tech Academy
Race Conditions
A race condition occurs when the outcome of a program depends on the timing and order of specific events.
This often happens when multiple processes or threads are trying to access or modify the same data at the
same time.

Here are some examples of race conditions:

• 2 people trying to withdraw money from bank at same time

• 2 people trying to buy the last item from the cart at the same time

• Traffic light changes to both green and red at once

Preventing Race Conditions

To prevent race conditions, programmers use techniques like:

• Synchronization: This involves coordinating the activities of multiple processes or threads to

ensure that they don't interfere with each other.

• Locking: This involves preventing multiple processes or threads from accessing the same data
at the same time.

• Atomic operations: These are operations that are guaranteed to be executed as a single,
indivisible unit.
Malicious Updates
• Malicious Updates are intentional distribution of compromised software updates to users or systems.

• Attackers control the update process or server, injecting malicious code into legitimate-looking
updates.

• When targeted systems install malware, backdoors, or harmful components, compromising security
and system integrity.

• This can lead to data breaches, system failures, and unauthorized access to sensitive information.

How to prevent:

Ensure update integrity through secure channels and verification processes to protect against such
threats.
OS Vulnerabilities

• OS Vulnerabilities are weaknesses in an operating system that attackers can exploit to

compromise security.

• It can be caused due to coding errors, misconfigurations, outdated software, and design flaws.

• An OS vulnerabilty can lead to unauthorized access, privilege escalation, arbitrary code

execution, or system disruption.

• Examples: Unpatched security holes, weak default settings, and flaws in system services.

• Prevention: Regular updates, security patches, and best practices for configuration and
hardening are crucial for protection.
SQL Injections
• SQL Injections can happen if a malicious SQL code can be inserted into a query to
manipulate a database and gain unauthorized access.

• This can happen due to improperly sanitized user inputs, allowing attackers to inject harmful
SQL statements.

• Due to SQL Injection attacks, an attacker can modify or retrieve data, bypass authentication,
or perform administrative operations.

• Example: Exploiting a vulnerable login form to access sensitive data or alter information.

• Prevention: Use parameterized queries, prepared statements, and proper input validation to
ensure safe handling of user inputs.
Cross Site Scripting (XSS)
Vulnerabilities
• XSS (Cross-Site Scripting): Occurs when attackers inject malicious scripts into webpages
viewed by other users.

• This can be caused due to improper validation or escaping of user input, allowing malicious
JavaScript to be embedded.

• Example: An attacker can exploit a comment section to insert a script that steals users'
cookies.

• XSS vulnerability can lead to session hijacking, data theft, and unauthorized user actions.

• Prevention: Implement input validation, secure coding practices, and content security
policies to handle user-generated content safely.
Hardware Vulnerabilities
• Hardware Vulnerabilities are weaknesses in physical components that can be exploited to
compromise system security or performance.
• These are different from Software Vulnerabilities since they come from design or
manufacturing flaws in hardware, not coding errors.
• Examples: Processor flaws (e.g., Spectre, Meltdown) allowing unauthorized access to
sensitive data, and firmware issues enabling hardware control.
• Hardware Vulnerabilities are quite challenging as they are difficult to patch, often requiring
hardware modifications or firmware updates.
• Prevention: Apply firmware updates, use physical security measures, and incorporate
hardware-based security features to mitigate risks.
VM Vulnerabilities
VM Vulnerabilities are weaknesses in virtualization technologies that can compromise
virtualized environments.
• Hypervisor Vulnerabilities: Sometimes, flaws in the hypervisor allow attackers to break out
of a VM and access the host or other VMs, leading to unauthorized access or data leakage.
• VM Escape: This vulnerabilties allow attackers break out of a VM to execute code on the
host system, potentially affecting other VMs or the host.
• Resource Contention: This vulnerability allows exploitation of shared resources (CPU,
memory, storage) to degrade performance or access sensitive data.
• Insecure VM Configuration: Misconfigurations like poor isolation or weak access controls
expose systems to attacks.
• Prevention: Regularly update virtualization software, apply security patches, ensure proper
VM isolation, and follow best configuration practices.
Cloud Vulnerabilities
Cloud Vulnerabilities are security weaknesses in cloud environments that compromise the
confidentiality, integrity, or availability of cloud resources and services.
Here's a list of some Common Cloud Vulnerabilities:
• Misconfiguration: Incorrect settings like weak access controls or insecure storage exposing
sensitive data.
• Data Breaches: Inadequate security measures leading to unauthorized access or data leakage.
• Insecure APIs: API weaknesses allowing unauthorized access or manipulation of cloud resources.
• Shared Resources: Poor tenant isolation causing data leakage or cross-tenant attacks.
• Account Hijacking: Compromised credentials leading to unauthorized access and exploitation of
cloud resources…
• Insufficient Security Controls: Lack of measures like encryption, logging, and monitoring increasing
risk.
Mitigating Cloud VM
Vulnerabilities
• Proper configuration management
• Regular security assessments
• Robust access controls
• Encryption
• Continuous monitoring
Supply Chain Vulnerabilities
Supply Chain Vulnerabilities are risks in the stages and components of a supply chain that can
compromise product integrity, security, or functionality.
Common Vulnerabilities:
• Third-Party Risks: Weak security practices or compromises of external vendors affecting the
entire supply chain.
• Malicious Code: Insertion of harmful code during development or distribution,
compromising systems upon deployment.
• Data Breaches: Interception or leakage of sensitive information due to inadequate security.
• Quality Control Issues: Substandard or counterfeit components causing failures or
vulnerabilities in final products.
• Insecure Software Dependencies: Risks from third-party libraries or components with
known vulnerabilities.
• Logistics and Transportation Risks: Physical tampering or theft of goods during logistics and
transportation.
Supply Chain Vulnerabilities
Mitigation Strategies:
• Thorough vetting of suppliers
• Robust security practices across all supply chain stages
• Regular audits
• Secure communication and data protection measures
Cryptographic Vulnerabilities
Cryptographic Vulnerabilities: Weaknesses in cryptographic algorithms, protocols, or
implementations that compromise data security and confidentiality.

Common Vulnerabilities:
• Weak Algorithms: Outdated algorithms (e.g., DES vs. AES) with insufficient encryption strength.
• Key Management Issues: Poor practices in generating, storing, or managing keys, including weak
keys or infrequent key rotation.
• Cryptographic Protocol Vulnerabilities: Flaws in protocols (e.g., SSL/TLS) leading to attacks like
man-in-the-middle or padding oracle…
• Insecure Hash Functions: Using outdated hash functions (e.g., MD5, SHA-1) vulnerable to collision
attacks.
Cryptographic Vulnerabilities
Mitigation Strategies:

• Use strong, up-to-date algorithms and protocols

• Follow best practices for key management
• Regularly review and update cryptographic implementations
Misconfiguration Vulnerabilities
Misconfiguration vulnerabilities are errors in setting up and configuring software, hardware, or
systems that lead to security vulnerabilities or operational issues.

Common Issues:
• Overly Permissive Permissions: Excessive access rights exposing sensitive data or systems.
• Default Settings: Unchanged default passwords or settings leaving systems vulnerable.
• Open Ports and Services: Unnecessary open ports or running services creating entry points for
attackers.
• Insecure Storage: Sensitive data stored without encryption or in accessible locations.
• Improper Network Configuration: Incorrect firewall, router, or VPN settings exposing systems to
attacks.
• Inadequate Security Controls: Lack of essential security measures like multi-factor authentication
or proper logging.
Misconfiguration Vulnerabilities
Mitigation Strategies:

• Regularly review and audit configurations

• Follow best practices for secure setup
• Apply least privilege principles
• Keep systems updated with security patches
 Mobile Device Vulnerabilities
Mobile Device Vulnerabilities are weaknesses in mobile devices and their operating systems that compromise
security, privacy, or functionality.

Common Vulnerabilities:
• Operating System Flaws: Bugs or weaknesses in mobile OS (e.g., iOS, Android) allowing unauthorized
access.
• App Vulnerabilities: Risks from malicious or poorly coded apps, including data leakage and malware.
• Insecure Communication: Weak network communication handling leading to data interception or man-in-
the-middle attacks.
• Unpatched Software: Exposure to known vulnerabilities due to outdated operating systems or apps.
• Phishing and Social Engineering: Attacks tricking users into revealing sensitive information or installing
malware.
• Insecure Storage: Sensitive data stored without encryption, risking theft if the device is compromised.
Mobile Device Vulnerabilities
Mitigation Strategies:

• Keep software and apps updated

• Use strong authentication methods
• Enable encryption
• Be cautious with app permissions and sources
• Employ mobile security solutions
• Follow best practices for device management
Zero Day Vulnerabilities
Zero-Day Vulnerabilities are unknown flaws in software or hardware that attackers exploit before the
vendor is aware.

• Zero Days means there are zero days available between the discovery of the vulnerability and
finding a solution.
• Zero day vulnerabilities are very high risk as they Can compromise systems, steal data, or cause
disruptions before patches are available.

The Process:
• When a zero day vulnerability is discovered, it is reported to the vendor.
• Vendor works on developing and deploying a patch or fix.
• Vulnerability remains a critical risk until resolved.
Zero Day Vulnerabilities
Defense Strategies:

• Use intrusion detection systems

• Employ behavioral analysis
• Ensure regular updates and comprehensive security measures
Vulnerability Management
Vulnerability Management: A systematic process to identify, evaluate, prioritize, and address security
weaknesses to minimize exploitation risks.

Key Steps:
• Discovery: Identify vulnerabilities using tools like scanners, penetration tests, or security
assessments.
• Assessment: Evaluate the impact and severity of vulnerabilities, considering exploitability and
potential damage.
• Prioritization: Rank vulnerabilities by risk level and focus on the most critical issues.
• Remediation: Apply fixes or mitigations, such as patches, configuration changes, or enhanced
security controls.
• Verification: Confirm that fixes are effective and no new issues have arisen.
• Monitoring and Reporting: Continuously monitor for new vulnerabilities and maintain reports for
tracking and compliance.
Vulnerability Management
Benefits:
• Protects against security breaches
• Reduces the attack surface
• Enhances overall security posture
Vulnerability Assessment
Introduction to Vulnerability Assessment
Vulnerability assessment is a process of identifying and evaluating security vulnerabilities in a system or
network. This process involves scanning and analyzing various aspects of the system, including hardware,
software, and network infrastructure, to identify any weaknesses that could be exploited by attackers.

The goal is to find potential weaknesses and once vulnerabilities are identified, the assessment team
provides recommendations for mitigating these weaknesses, which could include implementing security
controls, applying software patches, or making other configuration changes.

Conducting regular vulnerability assessments is essential to maintaining the security and integrity of an
organization's systems and data, and can help prevent costly data breaches and other security incidents.
Vulnerability Assessment
Types of VA
• White Box VA : Internal Assessment (Details provided)

• Black Box VA: External Assessment (Little / No details provided)

• Perform VA of 3rd party Web Application(s) used by the company

• VA of in-house app developed and used by the company

• Network Assessment (Wired / WIFI)…

• All of these
Vulnerability Assessment
Vulnerability Management Life Cycle

• Pre Engagement

• Engagement

• Post Engagement
Vulnerability Assessment
Vulnerability Management Life Cycle
Baseline: Pre engagement process.

• What is the client’s business?

• Processes?
• Understand the landscape of the business, what security controls they have in place, how they
operate so we can plan around those things.
• Build a list of applications to test, things to assess.
• Official paperwork & interrogations & meetings with clients and concerned parties.
Vulnerability Assessment
Vulnerability Management Life Cycle
Scheduling : We cant just start VA testing. We need written permission. We need to schedule VA.

• Systems slow / unresponsive / completely crash

• Servers Down
• Data loss
• Destruction of data
• Unavailability of services
• Affects customer confidence
• Downstream effects / dependencies
• Business gets affected

VA cannot be done during office hours / holidays /weekends -> make sure everything is back to normal
after assessment is very important.
Vulnerability Assessment
Vulnerability Management Life Cycle
Prioritizing: What’s more important?

Super vulnerable web application or the server patches being out of date?

You take a call based on your expertise or guide the client to help them prioritize. “This one is wide
open. This should be patched first”.

Sometimes, timings – some things may take few hours , something takes days and weeks.

How long does it take to patch? 5 hours - critical weakness

Let’s do this tonight from -> 12.00 - 5.00 am

5 min job – do now. 35 mins patch – do at lunch break, etc

2 days work – 50% this Sunday. 50% next sunday

Vulnerability Assessment
Vulnerability Management Life Cycle
Post Engagement: Take the vulnerabilities discovered and assess how they are a threat to the
company.

Risk Assessment : What is the impact of the vulnerabilities discovered:

• Loss of data
• Loss of reputation
• Lose customers
• Loss of revenue

After assessment reports – my fav part – lessons learnt here.

• What are the things that caused these vulnerabilities?

• How can we build a better infrastructure that is safer?
• How could we have improved?
• New procedures & control policies that lead to improved security.
Vulnerability Scanning
Vulnerability Scanning is an automated process don by pen testers to identify and assess security
weaknesses in systems, networks, and applications.

Here are the Steps:

• Preparation: Define scan scope and ensure permissions and credentials are in place.
• Scanning: Use a tool to check for known vulnerabilities, outdated software, missing patches, and
misconfigurations.
• Analysis: Analyze scan results to identify and assess the severity and impact of vulnerabilities.
Vulnerability Scanning
• Reporting: Generate a report with details on vulnerabilities, their severity, risks, and
recommendations for remediation.
• Remediation: Apply patches, reconfigure systems, or implement other security measures to
address vulnerabilities.
• Re-Scanning: Perform follow-up scans to verify resolution of vulnerabilities and identify new
issues.

Regular scanning helps proactively identify and address potential threats before they can be
exploited.
Application Security Scanning
Application Security Testing helps in identifying and addressing vulnerabilities before deployment,
reducing the risk of security breaches and protecting sensitive data and systems.

Key Aspects involved in application security testing:

• Static Application Security Testing (SAST): Analyzes source code, bytecode, or binaries without
executing the program to find coding errors and vulnerabilities.
• Dynamic Application Security Testing (DAST): Tests the running application to identify runtime
vulnerabilities such as input validation errors and session management issues.
• Interactive Application Security Testing (IAST): Combines SAST and DAST by analyzing the
application during runtime with code instrumentation, providing insights into vulnerability
exploitation.
Application Security Scanning
• Manual Code Reviews: Experts manually review code to find complex security issues that
automated tools may miss.
• Penetration Testing: Simulates real-world attacks using automated tools and manual techniques to
find exploitable vulnerabilities.
• Security Audits: Regular reviews of the application's architecture, design, and implementation to
ensure compliance with security standards.
Threat Feeds
Threat Feeds help organizations stay up-to-date by providing latest data on security threats to
enhance threat detection, response, and prevention.

Here are the places where you can obtain threat feeds:

• Commercial Threat Intelligence Providers: Companies that offer subscription-based threat feeds
with curated and real-time threat data.
• Open Source Threat Feeds: Publicly available threat feeds from community-driven sources and
security researchers.
• Government and Public Sector Sources: Threat feeds provided by government agencies and public
organizations focused on cybersecurity, such as CERTs (Computer Emergency Response Teams).
Threat Feeds
• Industry Information Sharing and Analysis Centers (ISACs): Industry-specific organizations that
share threat information and intelligence among members.

• Security Vendors: Threat feeds integrated into products from security vendors like antivirus
software and SIEM (Security Information and Event Management) systems.

• Cybersecurity Forums and Communities: Online forums and communities where researchers and
professionals share threat data and insights.

• Research Institutions: Academic and research organizations that publish threat intelligence and
vulnerability information.
Penetration Testing
Penetration testing helps organizations strengthen security by simulating real-world attacks to identify
and address weaknesses before they can be exploited.

Steps for Pen Testing:

• Planning and Scoping: Define the test’s scope, including systems, applications, and networks. Set
rules of engagement to avoid operational disruptions.
• Reconnaissance: Collect information about target systems, networks, or applications, such as IP
addresses and domain names, to plan the testing approach.
• Scanning and Enumeration: Use automated tools to detect open ports, services, and
vulnerabilities. Detailed probing identifies specific system and application details.
Penetration Testing
• Exploitation: Attempt to exploit identified vulnerabilities to gain unauthorized access or escalate
privileges, testing security controls and potential attack impact.

• Post-Exploitation: Evaluate the extent of access gained and potential damage, including lateral
movement within the network and accessing sensitive data.

• Reporting: Document vulnerabilities, exploited weaknesses, and attack impacts. Provide

recommendations for remediation and improving security.

• Remediation and Re-testing: Address identified vulnerabilities and, if needed, perform follow-up
testing to confirm resolution and check for new vulnerabilities.
Bug Bounty Programs
Bug bounty programs help organizations proactively identify and address security weaknesses,
enhancing their overall security posture and resilience against cyber threats.

• Organizations define the scope (systems, applications, or components), set rules of engagement
(allowed and off-limits activities), and decide on reward structures (monetary compensation or
recognition).
• Researchers and ethical hackers test the organization's systems or applications for vulnerabilities.
• Vulnerabilities are reported and submitted with details on how to reproduce the issue, its impact,
and mitigation strategies.
• The organization reviews and confirms the validity and severity of the reported vulnerabilities.
Bug Bounty Programs
Remediation: The organization fixes the confirmed vulnerabilities, prioritizing based on severity.

Reward and Recognition: Researchers are compensated according to the reward structure, and may
receive public acknowledgment or inclusion in a hall of fame.

Continuous improvement of the bug bounty program by updating scopes, refining rules, and adapting
to emerging security trends.
Bug Bounty Programs
Benefits:

• Enhanced Security: Access to a global pool of talent uncovers vulnerabilities that internal teams
might miss.
• Cost-Effective: Payments are made only for actual findings, potentially reducing overall security
assessment costs.
• Continuous Testing: Provides ongoing vulnerability discovery and security testing beyond periodic
assessments.
False Positives & False
Negatives
During a scan, there can be 4 possible results. The tests can be either be a :
• True Positive: There was an alert and the vulnerability was real.
• True Negative: There was no alert and there was no vulnerability.
• False Positive: There was an alert but there was no vulnerability.
• False Negative: There was no alert but there was a vulnerability.
Creating & Maturing A Vulnerability
Assessment Program
Establish Objectives and Scope:
Define Objectives: Set clear goals such as reducing risk, improving security posture, and ensuring
compliance.
Determine Scope: Identify which assets, systems, applications, and network components will be
included.
Creating & Maturing A Vulnerability
Assessment Program
Build the Foundation:

• Develop Policies: Create policies and procedures for identifying, assessing, prioritizing, and
addressing vulnerabilities.
• Assign Responsibilities: Designate roles and responsibilities for managing vulnerabilities among
security teams, IT staff, and other stakeholders.

Implement Discovery Tools:

• Select Tools: Choose appropriate vulnerability scanning and assessment tools, such as network
scanners, web application scanners, and configuration management tools.
• Configure and Deploy: Set up and deploy these tools for regular, comprehensive scans.
Creating & Maturing A Vulnerability
Assessment Program
Conduct Regular Scanning and Assessment:
• Schedule Scans: Perform regular vulnerability scans to identify both new and existing
vulnerabilities.
• Assess Findings: Evaluate the results to understand the severity, potential impact, and
exploitability of identified vulnerabilities.

Prioritize and Remediate:

• Prioritize Vulnerabilities: Rank vulnerabilities based on risk, impact, and exploitability, focusing on
high-risk issues.
• Remediation: Develop and implement remediation plans to address vulnerabilities, including
applying patches, reconfiguring systems, or deploying security controls.
Creating & Maturing A Vulnerability
Assessment Program
Verify and Validate:
• Re-scan: After remediation, re-scan systems to ensure that vulnerabilities have been effectively
addressed.
• Validate Fixes: Confirm that remediation actions have been successful and that no new
vulnerabilities have been introduced.

Continuous Improvement:
• Monitor and Review: Continuously monitor the program's effectiveness and review performance
metrics.
• Update Policies: Regularly update policies and procedures to adapt to new threats, technologies,
and regulatory requirements.
• Train and Educate: Provide ongoing training and education to staff on vulnerability management
practices and emerging threats.
Creating & Maturing A Vulnerability
Assessment Program
Documentation and Reporting:

• Document Findings: Keep detailed records of identified vulnerabilities, remediation efforts, and
outcomes.
• Report: Generate and distribute reports to stakeholders, including management, to keep them
informed about the status of vulnerability management and the organization's security posture.
Implementing Vulnerability
Management Lifecycle
Implementing Infrastructure Vulnerability Management Lifecycle
• Discovery: Use network scanners and configuration management tools to identify vulnerabilities in
servers, network devices, and other hardware components.
• Assessment: Evaluate discovered vulnerabilities based on their impact on network security and the
criticality of the affected infrastructure.
• Prioritization: Rank vulnerabilities according to their potential impact on business operations and
data security. Focus on critical systems and those with high exposure.
• Remediation: Apply patches, update configurations, or enhance security controls to address
vulnerabilities. Ensure that changes are tested and validated before deployment.
• Verification: Re-scan the infrastructure to confirm that vulnerabilities have been resolved.
Regularly audit configurations to prevent reintroduction of issues.
• Monitoring: Continuously monitor for new vulnerabilities and emerging threats through
automated tools and threat intelligence feeds.
Implementing Vulnerability
Management Lifecycle
Implementing Application Vulnerability Management Lifecycle
Discovery: Conduct static and dynamic application security testing (SAST and DAST) to identify
vulnerabilities in software code, web applications, and APIs.
• Assessment: Analyze vulnerabilities based on their potential to be exploited and the risk they pose
to application security and data integrity.
• Prioritization: Categorize vulnerabilities by severity and impact on the application’s functionality
and user data. Focus on vulnerabilities that could lead to significant breaches.
• Remediation: Implement code fixes, apply patches, and update application configurations to
address identified vulnerabilities. Perform secure coding practices to prevent future issues.
• Verification: Re-test the application to ensure that vulnerabilities have been effectively patched.
Use both automated and manual testing methods.
• Monitoring: Keep track of application security through ongoing testing, regular updates, and
monitoring for new vulnerabilities or exploits.
Implementing Vulnerability
Management Lifecycle
Implementing Cloud Vulnerability Management Lifecycle
Discovery: Use cloud security tools to scan cloud environments for vulnerabilities in cloud
infrastructure, configurations, and services.
• Assessment: Evaluate vulnerabilities considering the cloud provider’s shared responsibility model
and the potential impact on cloud resources and data.
• Prioritization: Rank vulnerabilities based on their impact on cloud security and compliance
requirements. Address issues affecting critical cloud services or data.
• Remediation: Apply cloud-specific patches, adjust configurations, and implement cloud security
controls to mitigate vulnerabilities. Follow best practices for cloud security management.
• Verification: Conduct regular assessments to ensure that vulnerabilities have been addressed and
that no new issues have emerged in the cloud environment.
• Monitoring: Continuously monitor cloud environments for vulnerabilities and threats using cloud
security tools and threat intelligence. Adapt to evolving cloud security landscapes and provider
updates.
Implementing Vulnerability
Management Lifecycle
Overall Implementation
• Integration: Ensure that vulnerability management processes are integrated across infrastructure,
applications, and cloud environments for a unified approach.
• Automation: Leverage automated tools for scanning, assessment, and monitoring to streamline
the vulnerability management lifecycle and improve efficiency.
• Governance: Establish governance frameworks to oversee vulnerability management activities,
ensuring alignment with organizational policies and regulatory requirements.
• Communication: Maintain clear communication with stakeholders about vulnerability status,
remediation efforts, and risk management strategies.
By implementing the vulnerability management lifecycle across infrastructure, applications, and cloud
environments, organizations can effectively identify and mitigate security risks, enhancing their
overall security posture and resilience.
Common Industry Challenges
1. Volume of Vulnerabilities:
o Challenge: Organizations often face an overwhelming number of vulnerabilities
due to the sheer volume of systems, applications, and devices.
o Best Practice: Implement automated vulnerability scanning tools and prioritize
vulnerabilities based on risk and potential impact to manage the volume
effectively.
Common Industry Challenges
2. False Positives and Negatives:
o Challenge: False positives can lead to alert fatigue, while false negatives may leave
real threats undetected.
o Best Practice: Use a combination of automated tools and manual verification to
reduce false positives and negatives. Regularly update and fine-tune scanning
tools to improve accuracy.
3. Patch Management:
o Challenge: Timely application of patches can be difficult, especially in large or
complex environments.
o Best Practice: Develop a structured patch management process with clear
timelines for applying and testing patches. Use automated patch management
tools to streamline the process.
Common Industry Challenges
4. Resource Constraints:
o Challenge: Limited resources and staff may hinder the ability to effectively manage
vulnerabilities.
o Best Practice: Prioritize vulnerabilities based on risk and impact, and focus
resources on critical areas. Consider leveraging managed services or outsourcing
certain aspects of vulnerability management.
5. Complex Environments:
o Challenge: Managing vulnerabilities across diverse environments, including on-
premises, cloud, and hybrid setups, adds complexity.
o Best Practice: Adopt a comprehensive vulnerability management strategy that
covers all environments. Use tools that offer visibility and control across different
platforms.
Common Industry Challenges
6. Evolving Threat Landscape:
o Challenge: The continuous evolution of threats and vulnerabilities makes it
challenging to stay ahead.
o Best Practice: Stay informed about emerging threats and vulnerabilities through
threat intelligence feeds. Regularly update security policies and practices to adapt
to the changing landscape.
7. Regulatory Compliance:
o Challenge: Ensuring compliance with industry regulations and standards can be
demanding.
o Best Practice: Integrate compliance requirements into the vulnerability
management process. Use compliance management tools to track and report on
adherence to relevant standards.
Best Practices
1. Establish a Structured Process:
o Create a defined vulnerability management process with clear roles,
responsibilities, and workflows for identifying, assessing, prioritizing, and
remediating vulnerabilities.
2. Automate Where Possible:
o Leverage automated tools for vulnerability scanning, assessment, and reporting to
improve efficiency and consistency. Ensure automation is complemented by
manual verification when needed.
3. Prioritize Risks:
o Focus on high-risk vulnerabilities that pose the greatest threat to your
organization’s critical assets. Use risk assessment frameworks and tools to
prioritize and address vulnerabilities effectively.
Best Practices
4. Integrate with Other Security Practices:
o Integrate vulnerability management with other security practices, such as incident
response, threat intelligence, and security monitoring, to create a cohesive
security strategy.
5. Regularly Review and Update:
o Continuously review and update vulnerability management policies, tools, and
processes to reflect changes in the threat landscape and organizational needs.
6. Educate and Train:
o Provide regular training and awareness programs for staff to keep them informed
about vulnerability management practices, emerging threats, and best practices.
7. Monitor and Measure: Implement metrics and KPIs to measure the effectiveness of
the vulnerability management program.
 Case Studies: Mature VM
Programs
Case Study: Large Financial Institution
•Overview: A global financial institution implemented a comprehensive vulnerability management program to
manage its complex IT environment and meet regulatory requirements.
Key Characteristics:
•Structured Process: Defined vulnerability management lifecycle with clear roles and procedures for
identification, assessment, prioritization, and remediation.
•Advanced Tools: Used cutting-edge vulnerability scanning tools integrated with threat intelligence for real-
time updates.
•Regular Scanning: Conducted automated scans across infrastructure, applications, and cloud, supplemented
by manual assessments.
•Prioritization Framework: Focused on high-impact vulnerabilities affecting business operations and customer
data.
•Patch Management: Automated patch deployment and testing for timely remediation.
•Continuous Improvement: Updated policies based on new threats, IT changes, and feedback from
assessments.
•Reporting and Compliance: Provided detailed reports to stakeholders and regulatory bodies to ensure
compliance.
Outcome: The institution reduced risk, improved security, and maintained regulatory compliance, enabling
proactive threat management.
 Case Studies: Immature VM
Programs
Case Study: Small E-Commerce Company
•Overview: A small e-commerce company with limited resources had an ad-hoc vulnerability management
approach, resulting in security issues.
Key Characteristics:
•Lack of Process: No formal process or defined roles, leading to reactive vulnerability management.
•Basic Tools: Relied on manual scanning tools with limited features and no threat intelligence integration.
•Infrequent Scanning: Scans were sporadic, often missing critical vulnerabilities.
•No Prioritization: Vulnerabilities were addressed without considering business impact or risk.
•Patch Management Issues: Delayed patching left the company exposed to known vulnerabilities.
•Limited Improvement: Rarely updated security practices, failing to adapt to new threats.
•Poor Reporting: Minimal reporting led to a lack of visibility and challenges in demonstrating compliance.
Outcome: The company suffered security incidents, data breaches, and operational disruptions due to
unaddressed vulnerabilities, resulting in increased risk and compliance challenges.
 Lessons Learnt
Lessons Learned
For Mature Programs:
 Best Practices: Comprehensive, structured processes, advanced tools, and regular reviews contribute to
effective vulnerability management.
 Continuous Improvement: Ongoing adaptation to new threats and technological changes is crucial for
maintaining a robust security posture.
 Lessons Learnt
For Immature Programs:
 Process Development: Establishing a structured vulnerability management process is essential for proactive
risk management.
 Tool Selection: Investing in advanced tools and integrating them with threat intelligence can improve
detection and assessment capabilities.
 Prioritization and Reporting: Implementing prioritization frameworks and generating detailed reports can
enhance focus on critical issues and demonstrate compliance.
These case studies highlight the impact of vulnerability management maturity on an organization’s overall
security effectiveness and provide valuable insights for improving vulnerability management practices.
 Patch Management, Updates,
Hotfixes
Patch Management: A systematic process to acquire, test, and apply patches to fix vulnerabilities and
improve system security, ensuring software stays up-to-date and protected against threats.

Updates: Regular releases from vendors that enhance functionality, performance, and security, keeping
software current with the latest features and fixes.

Hotfixes: Urgent patches addressing critical issues or vulnerabilities, applied immediately to resolve
problems without waiting for the next scheduled update.
 VAPT & OWASP

Module 3: VAPT & OWASP

Section B: Analysis & Reporting
Understanding CVSS
CVSS Score
What is CVSS?

CVSSS stands for Common Vulnerability Scoring System

CVSS is like a report card for security weaknesses. It helps measure how serious a security problem is.

Is it a low, medium, high, or critical threat?

CVSS gives a score to each vulnerability, making it easier to understand and prioritize which issues need fixing
urgently.
CVSS Score
CVSS Score
The CVSS score chart:
0 - None
0.1 - 3.9 - Low risk
4.0 - 6.9 - Medium risk
7.0 - 8.9 - High risk
9.0 - 10 - Critical risk

CVSS scoring system helps cyber security experts understand how risky a vulnerability is and how urgently it
needs to be fixed and helps organizations decide which vulnerabilities to address first.
Understanding CVE
CVE: Common Vulnerabilities & Exposures

• It's a system used to label the vulnerabilities or to give them unique identifiers to specific security
vulnerabilities found in software, hardware, or systems. This helps people in cybersecurity address these
vulnerabilities more easily.
• Helps experts, developers, and users easily refer to, understand, and discuss specific security problems.
• CVE improves cybersecurity by making vulnerability handling systematic and clear.
CVE
CVE: Common Vulnerabilities & Exposures
• A security issue is discovered and reported.
• The problem is assigned a CVE code (e.g., "CVE-2023-12345").
• The CVE code allows everyone to easily reference the specific issue.
• Management: CVE is maintained by MITRE Corporation, a nonprofit organization.
• Benefit: Enables easy lookup of vulnerability details, impact, and fixes, making software security more
accessible and manageable.
Hands On: Exploring CVEs
CVE: Common Vulnerabilities & Exposures
[Link] – cve list – search box

[Link] – Exploring CVEs of vendors & products

Red – high danger vulnerabilities. Orange . Green is not bad

Understanding CWE
CWE (Common Weakness Enumeration)
CWE is a community-developed list of common software and hardware weaknesses that
can lead to security vulnerabilities. It categorizes these weaknesses to help organizations
understand and mitigate root causes of security issues.
o Weakness Types: Describes types of software or hardware flaws (e.g., Buffer Overflow,
SQL Injection).
o Examples: Specific instances of weaknesses that can lead to vulnerabilities.
o Mitigation Strategies: Recommendations for preventing or addressing the identified
weaknesses.
CWE is used by developers, security professionals, and researchers to improve software
and hardware security by addressing common weaknesses. It helps in designing secure
systems and understanding the underlying causes of vulnerabilities.
 Recap
 CVSS: Provides a standardized method for scoring the severity of vulnerabilities to help prioritize
remediation efforts.
 CVE: Offers a unique identifier and description for each known vulnerability, facilitating identification and
information sharing.
 CWE: Lists common weaknesses that can lead to vulnerabilities, aiding in understanding and preventing
security issues.
Together, these frameworks and databases play a crucial role in vulnerability management, helping
organizations assess risk, identify vulnerabilities, and implement effective security measures.
 Accessing the Vulnerability
Databases
The 4 popular Vulnerability database frameworks are listed below:
1. The MITRE ATT&CK Framework maps out tactics and techniques used by cyber attackers, helping
organizations simulate attacks and improve defenses.

2. The National Vulnerability Database (NVD) is a repository of known software vulnerabilities, allowing
organizations to prioritize patching based on severity.

3. The OWASP Top 10 highlights the most critical web application security risks, guiding developers to
prevent common issues like SQL injection and XSS.

4. The SANS Top 25 lists the most dangerous software errors, helping teams address coding mistakes that
could lead to security vulnerabilities.
 Mitre Att&ck Framework
1. The MITRE ATT&CK Framework lists common techniques used by cyber attackers. It provides the
knowledge base of how attackers can attack.

2. It organizes attacks into stages (tactics) and specific methods (techniques) that hackers use.

3. The framework is based on real-world cyber incidents and provides examples of each technique.

4. Security teams use it to simulate attacks and improve defense strategies – helps in planning defense

It helps identify ways to detect and stop (mitigate) specific attack techniques.
 National Vulnerability Database
1. The NVD (National Vulnerability Database) is a collection of known software security issues.

2. It lists vulnerabilities by unique identifiers called CVEs (Common Vulnerabilities and Exposures).

3. Each vulnerability is rated with a severity score (CVSS) to help prioritize risks.

4. It provides details on how to fix or patch the listed vulnerabilities.

5. Anyone can access it to stay informed about potential security risks in their software. It is free & public
OWASP Top 10
OWASP - Open Web Application Security Project
1. The OWASP Top 10 highlights the most critical security risks for web applications.

2. It focuses on common issues & vulnerabilities like SQL injection, Cross-site Scripting (XSS), and security
misconfigurations.

3. It helps & guides developers to understand and avoid security mistakes during coding.

4. Each risk includes real-world examples of how attackers exploit it in real-world scenarios.

5. It’s widely used by organizations to improve the security of their web applications. OWASP is an industry
standard.
SANS Top 25 Software Errors

1. The SANS Top 25 lists the most dangerous coding mistakes and common software errors that lead to
security vulnerabilities.

2. These errors can be exploited by attackers to compromise systems and data in the real world.

3. SANS Top 25 helps developers to recognize and avoid common mistakes, like buffer overflows and
improper input validation. So, the focus is on prevention.

4. The list promotes secure coding practices to reduce the risk of introducing vulnerabilities.

5. It’s used by developers and security teams to strengthen software security and prevent attacks. It's an
industry guidance tool.
 Information Gathering For
Endpoints
Information gathering for endpoints is the process of collecting data about devices (endpoints) in a network.

Endpoint devices can be:

• Computers
• Servers
• Smartphones
• Any other device connected to the network.

This data can include details about:

• The hardware used

• Operating system
• IP Addresses & Mac Addresses
• Installed software
• Open ports
• Running services
• Vulnerabilities
• User activity.
 Information Gathering For
Endpoints
How does End Point Information Gathering help?

1. It helps in identifying vulnerabilities or misconfigurations in devices that could be exploited by attackers.

2. For attackers, it's a way to discover weak points in the system to target. Helps in atatck preparation.

3. Allows IT teams to understand all devices connected to the network and ensure they are compliant with
security policies. Helps in Network Visibility.

4. Helps in detecting unauthorized or suspicious devices, services, or activities on the network. Helps in Threat
Detection.

5. Useful during investigations to pinpoint compromised devices and determine how they were exploited.
Good for Incident Responss.
 Information Gathering For
Endpoints
Tools used for Information gathering:

• Network Scanner tools like Nmap or Angry IP Scanner are used to find active endpoints, open ports, and
running services.

• Vulnerability Scanner tools like Nessus or OpenVAS can be employed to detect known vulnerabilities in
endpoints.

• Endpoint Management Tools are used to retrieve system configurations, software inventories, and
compliance status.
 Information Gathering For
Endpoints
End Point Management Tools provide details like:

• Service Enumeration: Identify running services and their versions on endpoints to assess vulnerabilities.

• User Enumeration: Gather details on user accounts and permissions, which could reveal potential privilege
escalation threats.

• Check for Misconfigurations: Assess endpoint configurations for security flaws, such as unnecessary open
ports or weak passwords.

• Security Policies: Ensure that endpoint security policies adhere to best practices and organizational
guidelines.

• Perform Security Assessments like Patch Management

• Vulnerability Assessment: Analyze the collected data to prioritize vulnerabilities based on their potential
risk and impact.
 Information Gathering For
Endpoints
Document your Findings: Create a detailed report summarizing the gathered information, vulnerabilities, and
recommendations for remediation.

Maintain an updated inventory of endpoints, including configurations, vulnerabilities, and software details.

Follow-Up Actions:

Mitigation: Apply security measures and patches to address the identified risks.
Monitoring: Continuously monitor endpoints for new vulnerabilities and configuration changes.

Continuous Improvement

Feedback Loop: Use findings to update and refine security policies and practices. Regularly review and adapt
information gathering processes to account for new threats and technologies.

By systematically gathering and analyzing information about endpoints, organizations can identify potential
vulnerabilities, strengthen their security posture, and mitigate risks proactively.
 Application Assessment with Nikto
Application Assessment Using Nikto Tool

Ping Scan: First Check if the target is reachable and identify live hosts.
nmap -sn <target-IP>

Service Discovery: Scan open ports and discover running services.

nmap -sS <target-IP>
-sS initiates a SYN scan, commonly used to identify open ports.

Service and Version Detection: Determine the specific services and versions running on the discovered open
ports.
nmap -sV <target-IP>
-sV enables version detection, helping identify software vulnerabilities.
 Application Assessment with Nikto
Operating System Detection
Identify the operating system of the target application server, useful for OS-specific vulnerability assessment.
nmap -O <target-IP>
-O triggers OS detection in the scan.

Script Scanning: Run Nmap scripts to detect known vulnerabilities, providing more detailed analysis.
nmap --script vuln <target-IP> -oN [Link]
--script vuln runs vulnerability detection scripts for deeper security insights.

Application-Specific Scanning
Web Application Testing: If the target is a web application, use HTTP-specific scripts to gather more information
about the web server and its structure.

nmap --script http-enum <target-IP> -oN [Link]

http-enum enumerates directories and files on the web server to assess potential exposures.
 VAPT With Nikto
Hands On: Nikto for Vulnerability Assessment

#nikto
(h – host)

Checks for outdated versions and other vulnerabilities

• #nikto –h [Link] (IP of Metasploitable)

• #nikto -h [Link]

• #nikto –h [Link] –output [Link]

• #Firefox [Link]
 VAPT & OWASP

Module 3: VAPT & OWASP

Section C: Penetration Testing & OWASP
 VAPT With MBSA
MBSA: Microsoft Baseline Security Analyzer
• MBSA (Microsoft Baseline Security Analyzer): A free security tool by Microsoft for assessing system security
and identifying missing updates.

• Compatibility: Works with Microsoft Windows OS (Windows 7, 8, 10, and Windows Server) and can scan
individual computers or entire networks.

• Function: Analyzes security configuration, installed software, and patch levels, providing a summary report
of vulnerabilities or issues.

• Compliance Check: Can verify compliance with security standards like PCI DSS and FDCC.

• Benefit: Helps organizations using Microsoft Windows systems identify missing updates and offers
guidance on resolving security issues.

[Link]
 Quick Heal Total Security
Using Quick Heal Total Security
 Pen Testing Web Applications
Online
[Link]
 Pen Testing Web Applications
Online
Nessus is a popular vulnerability scanning tool that can be used to identify security risks in your network and systems.

Installing & using Nessus in Kali Linux: [Link]

Download Nessus 64 Bit Debian Package

Kali: sudo dpkg -i Nessus-8.10.1-debian6_amd64.deb

Fix missing dependencies if required: sudo apt --fix-broken install

Now run the command to start Nessus: sudo systemctl start nessusd
Or: /bin/systemctl start [Link]

- To make Nessus start automatically on boot, run: sudo systemctl enable nessusd

Confirm if Nessus service is running: sudo systemctl status nessusd

 Pen Testing Web Applications
Online
- Open your browser use IP address of your kali linux: [Link]

Register Nessus Essentials – Free Version - Fname, lname, email, activation code.

Download Plugins will automaticallybegin. This will take a very long time.

Create New Scan – Choose scan type eg: Web application scan, Basic Network Scan - Scan the Windows & Metasploitable
OS Ips

You are now ready to run vulnerability scans with Nessus on Kali Linux!

Name: pen lname: tester

User: pentester61073
Pass: Pt@$61073

email: sivij73230@[Link]

Activation Code: N6TJ-9ME3-6J5Z-PEYK-Y5RB