7.1 Vulnerability Scanning Principles & Methodology

CREST Practitioner Security Analyst CPSA

Track your progress as you read

Finished sections get a check mark.

1 Chapter 1: Soft Skills, Legal Framework & Assessment Management

1.1 The Penetration Testing Engagement Lifecycle & Scoping 1.2 Legal Framework: Computer Misuse Act & Compliance 1.3 Understanding, Explaining & Managing Technical Risk 1.4 Record Keeping, Interim Escalation & Reporting Standards

2 Chapter 2: Core Networking: IP Protocols & Network Architectures

2.1 IPv4 and IPv6 Addressing, Subnetting & Header Architecture 2.2 TCP and UDP Transport Protocols & Handshake Mechanics 2.3 ICMP Protocol, Network Diagnostics & Error Messages 2.4 Network Topologies, Switched Media & VLAN Segmentation 2.5 Network Media, Ethernet Standards & Physical Topologies

3 Chapter 3: Cryptography & Secure Communication Protocols

3.1 Symmetric & Asymmetric Cryptographic Algorithms 3.2 Cryptographic Hash Functions, MACs & Digital Signatures 3.3 Secure Protocols: SSL/TLS, IPsec & SSH

4 Chapter 4: Background Information Gathering & OSINT Reconnaissance

4.1 WHOIS Records, Domain Registrars & Autonomous Systems 4.2 DNS Infrastructure, Record Types & Zone Transfers 4.3 Search Engine Reconnaissance, Google Dorking & Information Leakage 4.4 Newsgroups, Mailing Lists & Public Archive Reconnaissance

5 Chapter 5: Networking Equipment & Infrastructure Protocols

5.1 Router & Switch Management: SNMP, SSH & Authentication 5.2 Layer 2 Protocols: ARP, CDP, STP, VTP & Redundancy 5.3 Core Network Services: DHCP, NTP & TFTP 5.4 Wireless Security (802.11) & VoIP Assessment 5.5 Out-of-Band Management, Console Access & Cisco Reverse Telnet

6 Chapter 6: Network Mapping, Nmap Techniques & Target Identification

6.1 Host Discovery Techniques & Ping Sweep Methodologies 6.2 Port Scanning Mechanics: TCP, UDP & Stealth Scans 6.3 OS Fingerprinting, Service Detection & Timing Templates 6.4 Firewall and IDS/IPS Evasion Techniques 6.5 Passive OS & Service Fingerprinting 6.6 Network Access Control Analysis & Firewall Rule Base Review

7 Chapter 7: Vulnerability Identification & Tool Output Analysis

7.1 Vulnerability Scanning Principles & Methodology 7.2 CVE Referencing, CVSS Scoring & Risk Prioritisation 7.3 Banner Grabbing, Service Verification & Manual Triage 7.4 Host Audit Techniques: Processes, Sockets, Patch Levels & Interesting Files

8 Chapter 8: Microsoft Windows Security Assessment & Active Directory

8.1 Active Directory Architecture & Domain Reconnaissance 8.2 Windows User & Group Enumeration via SMB & RPC 8.3 Windows Authentication: NTLM, Kerberos & Password Security 8.4 Windows Patch Management, Local Security & Common Services 8.5 Windows File System, Share & Registry Permissions 8.6 Desktop Lockdown, Citrix Breakout & Common Windows Applications

9 Chapter 9: Unix & Linux Security Assessment & Legacy Services

9.1 Linux/Unix Security Architecture, Permissions & Filesystem 9.2 Unix User Enumeration & Service Discovery 9.3 Network File System (NFS) & RPC Services Assessment 9.4 Legacy Unix Services: R-Services, X11, FTP & Modern SSH 9.5 Unix Remote Information Services: rusers, rwho, finger & systat 9.6 Unix Vulnerability Exploitation & Post-Exploitation Workflow

10 Chapter 10: Web Architectures, Technologies & Testing Methodologies

10.1 Web Server Architecture & the HTTP/HTTPS Protocol 10.2 Web Application Components, Frameworks & State Management 10.3 Web Reconnaissance, Content Discovery & Threat Modelling 10.4 Testing Authentication, Authorization & Session Management 10.5 Web Service Protocols: SOAP, REST & XML Messaging 10.6 Web APIs, Server Extensions & Client-Side Sub-Components

11 Chapter 11: Web Testing Techniques & OWASP Top Vulnerabilities

11.1 Input Validation Vulnerabilities & Parameter Manipulation 11.2 Cross-Site Scripting (XSS): Types, Impact & Defenses 11.3 Cross-Site Request Forgery (CSRF) & Client-Side Attacks 11.4 Command Injection, File Upload Vulnerabilities & API Flaws 11.5 Information Disclosure: Error Messages & Mark-up Leakage 11.6 Injection Beyond SQL: LDAP, XPath, Code & Template Injection 11.7 Source Code Review & Encoded/Cryptographic Value Analysis

12 Chapter 12: Database Security Assessment & SQL Injection

12.1 Database Architectures, Default Ports & Authentication 12.2 SQL Injection (SQLi) Foundations & In-Band Techniques 12.3 Blind SQL Injection & Database Enumeration 12.4 Database Attack Vectors, Stored Procedures & Hardening

7.1 Vulnerability Scanning Principles & Methodology

Key Takeaways Explain This Topic AI

Vulnerability scanning provides an automated, broad horizontal inventory of potential security flaws across network assets without active exploitation, whereas penetration testing validates vulnerabilities through manual exploitation, context analysis, and chained attack vectors.

Network-based active scanners (such as Tenable Nessus, Qualys VMDR, and Greenbone/OpenVAS) execute plugin-driven probe suites across target networks, while host-based agent scanners continuously audit local configurations and patch states without consuming network bandwidth.

Credentialed (authenticated) scans execute local commands, audit registry keys, and inspect file system permissions, eliminating banner-guessing false positives and uncovering missing software patches invisible to uncredentialed network-perimeter scans.

Passive vulnerability detection (e.g., Tenable Nessus Network Monitor) analyzes mirrored network traffic to discover active hosts and legacy services without generating probe traffic or risking denial-of-service conditions on sensitive operational technology (OT) assets.

Intrusive or unsafe scanning checks, which transmit malformed packets or test for buffer overflows, carry significant operational risks of crashing legacy daemons or industrial control systems, necessitating strict pre-engagement authorization.

Last updated: September 2026

7.1 Vulnerability Scanning Principles & Methodology

Vulnerability assessment is a cornerstone of modern information security operations and technical penetration testing. In enterprise security management, organizations must maintain continuous visibility over potential weaknesses across thousands of operating systems, network appliances, databases, and application endpoints. For a CREST Practitioner Security Analyst (CPSA), understanding the foundational mechanics, operational architectures, and practical limitations of vulnerability identification tools is vital. Flawed tool configuration or misinterpretation of scanner output directly leads to erroneous risk ratings, wasted remediation engineering cycles, or catastrophic unmitigated exposures.

Vulnerability Scanning vs. Penetration Testing

A frequent misconception among junior analysts and organizational stakeholders is conflating an automated vulnerability scan with a comprehensive penetration test. While vulnerability scanning often serves as the initial discovery and reconnaissance phase of a technical assessment, the two methodologies differ fundamentally across objectives, execution, depth, and risk validation. +-----------------------------------------------------------------------------+

• | VULNERABILITY ASSESSMENT vs PENETRATION TEST |
• +-----------------------------------------------------------------------------+
• | Vulnerability Assessment (Breadth) |
• | [Target Subnet] ---> [Automated Scanner] ---> [Identified CVE Signatures] |
• | * Automated, high-coverage enumeration across all IP endpoints. |
• | * Assumes potential flaw is present based on version or banner check. |
• | * Does not prove real-world exploitability or business impact. |
• +-----------------------------------------------------------------------------+
• | Penetration Testing (Depth) |
• | [Scanner Output] ---> [Manual Validation] ---> [Exploit] ---> [Pivot] |
• | * Goal-oriented, adversarial simulation targeting high-value assets. |
• | * Actively chains vulnerabilities to bypass perimeter defenses. |
• | * Validates environmental controls, detection capabilities, and blast radius.|
• +-----------------------------------------------------------------------------+
• Comparative Architectural Breakdown

Dimension Automated Vulnerability Scanning Penetration Testing

Core Objective Maintain an exhaustive inventory of known unpatched vulnerabilities and misconfigurations across all network assets. Simulate realistic adversarial attack paths to identify exploitable flaws that compromise confidentiality, integrity, or availability.

Execution Paradigm Highly automated; driven by scheduling engines and standardized signature/plugin repositories. Highly manual and human-driven; relies on tester methodology, creative problem-solving, and customized tooling.

Exploitation & Impact Non-exploitative by default; tests identify potential flaws without executing weaponized payloads. Actively exploits confirmed vulnerabilities to demonstrate business risk, establish persistence, exfiltrate test data, or pivot.

Contextual Awareness Low; evaluates targets in isolation without understanding compensating controls, architecture, or business logic. High; evaluates security posture within the organization's unique operational, network, and defense-in-depth architecture.

Frequency & Cadence Continuous or high-frequency recurring cadence (e.g., daily, weekly, or monthly scanning). Periodic, point-in-time assessment (e.g., annual compliance audit, post-major architectural change).

Reporting Output Massive quantitative vulnerability inventories categorized by raw CVSS scores (often hundreds of pages). Curated, risk-prioritized findings report detailing reproduction steps, chained attack narratives, and remediation guidance.

Vulnerability Scanner Architectures & Core Engine Components

Modern vulnerability management platforms deploy distributed architectural models to assess complex hybrid enterprise environments spanning on-premises data centers, branch offices, and multi-cloud networks. CENTRAL CONSOLE

• +------------------------------+
• | Management, Policy Engine, |
• | Plugin Feed & Reporting DB |
• +------------------------------+
• | (Dispatch & Orchestration)
• +------------------------+------------------------+
• | |
• v v
• NETWORK ACTIVE SCANNER HOST-BASED AGENTS
• +-----------------------+ +-----------------------+
• | Port Scanner Engine | | Local File Auditor |
• | Protocol Interrogator | | Registry / Config DB |
• | Plugin Script Engine | | Package DB Inspector |
• +-----------------------+ +-----------------------+
• | (Active Network Probes) | (Encrypted Telemetry Out)
• v v
• [Remote Server / Switch] [Workstations / Cloud VM]
• 1. Active Network-Based Scanners vs. Host-Based Agent Scanners

Network-Based Active Scanners (e.g., Tenable Nessus, Qualys Scanner Appliance, Greenbone Vulnerability Management / OpenVAS):

Deployment Model: Deployed as virtual appliances, physical hardware units, or cloud-hosted engines positioned inside or outside the network perimeter.

Mechanics: Transmits active Layer 3, 4, and 7 network packets targeting destination IP addresses across subnets. The scanner negotiates network handshakes, captures banners, and dispatches protocol-specific probes.

Strengths: Ideal for network perimeter assessments, discovering unauthorized "shadow IT" devices, evaluating firewalls, routers, switches, and unmanaged IoT devices where agent installation is impossible.

Limitations: Dependent on network connectivity, firewall routing rules, and bandwidth constraints; unable to evaluate endpoints that are offline or roaming outside the enterprise boundary.

Host-Based Agent Scanners (e.g., Qualys Cloud Agent, Tenable Agent, Rapid7 Insight Agent):

Deployment Model: Lightweight background software daemons installed directly onto target operating systems (Windows, Linux, macOS).

Mechanics: Continuously monitors local system state, querying local package management databases (e.g., RPM, APT), registry keys, local user configurations, and installed software binaries. Telemetry data is compressed and transmitted outbound over TLS (port 443) to a central management console.

Strengths: Zero network scanning bandwidth overhead; seamless visibility into ephemeral cloud instances and remote mobile laptops; immune to network firewall drops or packet loss.

Limitations: Requires administrative privileges to install and maintain; cannot assess network devices (routers, switches, printers) or embedded hardware.

2. Anatomy of a Vulnerability Scanner Engine

A network vulnerability scanner engine comprises four synchronized operational subsystems:

Plugin / Signature Database: A modular repository of vulnerability check scripts (written in specialized scripting languages, such as Nessus Attack Scripting Language [NASL] or Python). Each plugin contains metadata (CVE references, CVSS vectors, solution descriptions) and executable code designed to detect a specific flaw.

Scheduling & Orchestration Engine: Regulates scan execution times, parallel host concurrency limits, scan thread pools, and network bandwidth throttling to avoid overwhelming enterprise switching fabrics or WAN links.

Discovery & Port Scanning Engine: Executes pre-scan host discovery (using ICMP, TCP, or ARP ping sweeps) and transport-layer port scanning to map responsive services before launching vulnerability checks.

Vulnerability Check Execution Engine: Conditionally dispatches specific plugins based on the operating system, transport ports, and application banners identified during the enumeration phase, avoiding irrelevant probe execution (e.g., suppressing Microsoft IIS plugins when scanning an Apache server on Linux).

Credentialed (Authenticated) vs. Uncredentialed (Unauthenticated) Scanning

The depth, fidelity, and technical accuracy of a vulnerability scan depend directly on whether the scanner possesses valid administrative credentials to access the target's operating system. +-----------------------------------------------------------------------------+

• | CREDENTIALED vs UNCREDENTIALED SCANNING |
• +-----------------------------------------------------------------------------+
• | UNCREDENTIALED (Perimeter / Remote Perspective) |
• | |
• | Scanner =====[Network Port Probes]=====> [Open Port 80 / Apache 2.4.41] |
• | * Sees only external banner. |
• | * Guesses vulnerabilities. |
• | * Blind to local patches & apps. |
• +-----------------------------------------------------------------------------+
• | CREDENTIALED (Insider / System Audit Perspective) |
• | |
• | Scanner =====[SSH / SMB / WMI Auth]=====> [Kernel & Local Filesystem] |
• | * Audits 'dpkg -l' / RPM DB. |
• | * Reads Windows Registry hotfixes.|
• | * Inspects file permissions. |
• | * Near-zero false positive rate. |
• +-----------------------------------------------------------------------------+
• 1. Uncredentialed (Unauthenticated) Scanning

Perspective: Simulates an external threat actor or unauthorized network adversary operating without internal network privileges.

Methodology: The scanner interrogates listening network ports across the transport layer, inspecting returned service banners, protocol negotiation handshakes, and application headers.

Blind Spots & Deficiencies:

Completely blind to local client-side vulnerabilities (e.g., vulnerable web browsers, PDF readers, Microsoft Office suites) that do not listen on open network ports.

Unable to verify whether a vulnerable network daemon has compiled-in mitigations or backported security fixes.

Cannot inspect local file permissions, insecure service configuration files, weak local password policies, or missing kernel hotfixes.

2. Credentialed (Authenticated) Scanning

Perspective: Simulates an authorized auditor, trusted insider, or an adversary who has obtained valid domain credentials or established a local foothold.

Methodology: The scanner uses administrative credentials to log into target systems via secure management protocols: SSH for Unix/Linux systems (using public-key authentication or sudo ), and SMB / WMI / WinRM for Windows systems.

Local Inspection Mechanisms:

Windows: Queries the Windows Registry (specifically inspecting installed updates in HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages ), queries Windows Management Instrumentation ( wmic qfe get HotFixID ), and verifies file system Access Control Lists (ACLs).

Linux / Unix: Executes package manager queries directly ( rpm -qa , dpkg -l , pacman -Q ), inspects configuration files (e.g., /etc/ssh/sshd_config ), audits running process trees, and checks file ownership.

Comparison Table: Uncredentialed vs. Credentialed Scanning

Assessment Parameter Uncredentialed (Remote) Scan Credentialed (Local) Scan

Network Overhead Higher (thousands of probe packets sent per host). Lower (authentication session followed by local execution).

Visibility Scope Restricted to exposed, listening network services. Comprehensive (OS kernel, client apps, configs, registry).

False Positive Rate High (relies on banner version matching and heuristics). Extremely Low (validates actual binary hashes and patch records).

Setup Overhead Minimal; requires only network reachability. High; requires provisioning dedicated service accounts, managing SSH keys/passwords, and firewall access.

CPSA Exam Context Identifies external perimeter exposures. Standard for enterprise compliance audits and internal reviews.

Active Scanning vs. Passive Vulnerability Detection

While active scanning actively injects traffic into target networks, passive vulnerability detection operates purely by observing ambient network communications. PASSIVE MONITORING

• +----------------+
• | Passive Sensor | (Tenable NNM / Zeek)
• +----------------+
• ^
• | (Span / Mirror Port - Read Only)
• [Workstation A] <================== Enterprise Switch ==================> [Database Server]
• (Client-Server Network Traffic Flow)
• 1. Active Vulnerability Scanning Mechanics

Active scanners transmit synthetic network packets (ARP requests, TCP SYN packets, HTTP requests, SNMP queries) directly to target hosts. When target daemons respond, the scanner analyzes the response data against its vulnerability database. While active scanning provides exhaustive, on-demand coverage, it generates substantial network traffic, triggers intrusion detection system (IDS/IPS) alarms, and presents operational risks to fragile devices.

2. Passive Vulnerability Detection Mechanics

Passive vulnerability detection systems (such as Tenable Nessus Network Monitor [NNM] , formerly known as the Passive Vulnerability Scanner [PVS], or Zeek ) do not transmit a single packet onto the target network. Instead, the sensor connects to a network TAP (Test Access Point) or a switch SPAN (Switched Port Analyzer) / mirror port .

Continuous Asset Discovery: Discovers transient endpoints (e.g., mobile devices, BYOD laptops, rogue virtual machines) the instant they communicate on the network, capturing assets that connect between scheduled active scan windows.

Protocol & Traffic Reconstruction: Reconstructs client-server application exchanges in real time, identifying vulnerable software versions transmitted in plaintext banners (HTTP User-Agents, FTP/Telnet negotiations, SMTP headers, TLS Client Hellos).

Zero Impact on Operational Technology (OT): In Industrial Control Systems (ICS), SCADA environments, and medical device networks, active probe packets (such as malformed Modbus, DNP3, or BACnet frames) can crash Programmable Logic Controllers (PLCs), halt manufacturing assembly lines, or compromise patient safety systems. Passive network monitoring is the gold standard for vulnerability detection in these fragile, mission-critical environments.

Limitation: Passive sensors can only analyze systems that are actively communicating across the monitored network segment. An unpatched, dormant service listening silently on an isolated server will remain completely undetected until it transmits or receives network traffic.

False Positives, False Negatives & Safe Checking

Interpreting scanner output requires a rigorous technical understanding of statistical error types and scanner sensitivity configurations. +-----------------------------------+-----------------------------------+

• | FALSE POSITIVE | FALSE NEGATIVE |
• | (Type I Error) | (Type II Error) |
• +-----------------------------------+-----------------------------------+
• | * Scanner reports a vulnerability | * Vulnerability exists on target, |
• | that does NOT actually exist. | but scanner fails to detect it. |
• | * Caused by banner heuristics and | * Caused by packet drops, WAF |
• | unverified package backports. | blocking, or uncredentialed scan.|
• | * Wastes analyst triage time. | * Leaves critical attack vectors |
• | | unmitigated and exposed. |
• +-----------------------------------+-----------------------------------+
• 1. False Positives (Type I Errors)

Definition: The scanner flags a vulnerability that does not exist on the target system.

Primary Root Causes:

Banner Heuristics: The scanner reads an exposed version string (e.g., OpenSSH 7.4 ) and cross-references it against known vulnerabilities, without verifying whether the vulnerable code path is enabled in the configuration file.

Package Backporting: Enterprise Linux distributions (Red Hat, Debian, Ubuntu) patch security vulnerabilities without incrementing the upstream version number. The scanner flags the software based on the base version, unaware that the vendor has backported the fix.

Proxy / WAF Interception: A Web Application Firewall or reverse proxy returns a default server banner (e.g., cloudflare or nginx ), masking the real backend daemon.

Operational Impact: Generates alert fatigue, erodes trust between security teams and systems administrators, and causes development teams to waste hundreds of engineering hours chasing non-existent bugs.

2. False Negatives (Type II Errors)

Definition: A severe security vulnerability exists on the target system, but the scanner reports the host as clean or low-risk.

Primary Root Causes:

Firewall & Rate Limiting Drops: State-filtering firewalls or intrusion prevention systems drop probe packets during scanning, causing the scanner to conclude that the target port is closed or filtered.

Uncredentialed Visibility Constraints: The scanner cannot log into the host and misses critical client-side vulnerabilities, local privilege escalations, and internal database flaws.

Outdated Plugin Repository: The scanner engine has not synchronized its vulnerability feed, leaving it blind to newly discovered Zero-Day or N-Day vulnerabilities.

Custom / Proprietary Software: Automated scanners rely on known CVE signatures and cannot detect bespoke architectural flaws or zero-day vulnerabilities in proprietary applications.

Operational Impact: Catastrophic; creates a false sense of organizational security while leaving severe attack paths wide open for adversarial exploitation.

3. Safe Checking vs. Intrusive / Unsafe Checks

Vulnerability scanners incorporate configuration toggles governing check invasiveness:

Safe Checks (Default Mode): The scanner relies on passive version interrogation, non-destructive protocol handshakes, and RFC-compliant probe queries. If a plugin must test for an exploitable condition, it transmits benign input designed to verify the flaw without disrupting service execution.

Unsafe / Intrusive Checks: The scanner actively launches aggressive exploit payloads, including deliberate memory buffer overflow strings, heavy multi-threaded denial-of-service loops, malformed protocol headers, and recursive web crawler sequences.

Caution

Operational Danger of Unsafe Checks: Enabling unsafe checks during an enterprise assessment presents severe operational risks. On legacy operating systems (such as Windows Server 2003 or legacy Solaris), fragile network appliances, or SCADA/ICS hardware, buffer overflow checks can trigger unhandled kernel panics, crash listening daemons, corrupt active database records, or cause unrecoverable hardware lockups. Unsafe checks must never be executed without explicit, written authorization in the formal Rules of Engagement (RoE).