Week 5 — Vulnerability research

Learning objectives

• Move from a discovered service to a qualified vulnerability.
• Use CVE, NVD and CVSS without being fooled by raw scores.
• Filter Nikto false positives and cross-check results.

Reading a CVE record correctly

• CVE = unique identifier, nothing more.
• CVSS = theoretical severity score. A CVSS 9.8 without Internet exposure can be far less dangerous than a publicly exposed CVSS 6.5.
• EPSS = probability of exploitation within 30 days. Complements CVSS for prioritization.
• KEV (CISA) = list of actively exploited vulnerabilities. Top priority.

Toolbox

# Local, offline search in the exploit database.
searchsploit "Apache 2.4.49"

# Generic web analysis. Lots of noise, must be cross-checked.
nikto -h https://example.com -Format txt -o reports/nikto.txt

# More targeted scan once you know what you are looking for.
nuclei -u https://example.com -tags cve,exposure -severity high,critical

Method — From discovery to finding

1. List the services with version from the week 4 scans.
2. Query CVE/NVD and the KEV index for each version.
3. Confirm manually: the version shown is sometimes misleading (backported patch, frozen header). No finding without reproduction.
4. Document: URL tested, request sent, response observed. Screenshot or curl -v capture to back it up.

Prioritization

A pentest should not produce a flat list of 200 lines. Group:

Priority	Criteria
P1	Exploitable unauthenticated + public exposure + KEV or public PoC
P2	Exploitable with a standard account + access to data
P3	Exploitable under rare conditions, limited impact
P4	Configuration flaw, to be fixed without urgency