Overview
Vulnerability assessment is an important part of identifying and evaluating system vulnerabilities. This skill provides methods, tools, and best practices for vulnerability assessment.
Assessment Process
1. Scope Determination
Determine scope:
- Target system
- Network scope
- Application scope
- Testing depth
2. Information Gathering
Collect information:
- System information
- Network topology
- Service information
- Application information
3. Vulnerability Scanning
Scan types:
- Network scanning
- Host scanning
- Application scanning
- Configuration scanning
4. Vulnerability Verification
Verification methods:
- Manual verification
- Tool verification
- Proof of concept
- Impact assessment
5. Risk Assessment
Assessment factors:
- Vulnerability severity
- Exploitation difficulty
- Scope of impact
- Business impact
Scanning Tools
Network Scanning
Using Nessus:
# 启动Nessus
# 创建扫描任务
# 配置扫描策略
# 执行扫描
# 分析结果
Using OpenVAS:
# 启动OpenVAS
gvm-setup
# 创建扫描任务
# 执行扫描
# 分析结果
Using Nmap:
# 漏洞扫描
nmap --script vuln target
# 特定漏洞
nmap --script smb-vuln-ms17-010 target
Application Scanning
Using Burp Suite:
# 配置代理
# 浏览应用
# 被动扫描
# 主动扫描
# 分析结果
Using OWASP ZAP:
# 启动ZAP
zap.sh
# 快速扫描
zap-cli quick-scan http://target.com
# 完整扫描
zap-cli full-scan http://target.com
Using Acunetix:
# 启动Acunetix
# 创建扫描任务
# 配置扫描选项
# 执行扫描
# 分析结果
Code Scanning
Using SonarQube:
# 运行扫描
sonar-scanner
# 分析结果
# 查看报告
Using Checkmarx:
# 使用Web界面
# 上传代码
# 执行扫描
# 分析结果
Vulnerability Classification
By Severity
Critical:
- Remote code execution
- SQL injection
- Authentication bypass
- Sensitive data leakage
High:
- Privilege escalation
- Information disclosure
- Business logic vulnerabilities
- Misconfiguration
Medium:
- XSS vulnerabilities
- CSRF vulnerabilities
- Weak passwords
- Insecure configuration
Low:
- Information disclosure
- Configuration recommendations
- Best practices
- Information gathering
By Type
Injection vulnerabilities:
- SQL injection
- Command injection
- LDAP injection
- XPath injection
Authentication vulnerabilities:
- Weak passwords
- Session fixation
- Authentication bypass
- Password reset
Authorization vulnerabilities:
- Privilege escalation
- IDOR
- Horizontal privilege
- Vertical privilege
Misconfiguration:
- Default configuration
- Incorrect configuration
- Insecure storage
- Sensitive information disclosure
Risk Assessment
CVSS Scoring
Base metrics:
- Attack Vector (AV)
- Attack Complexity (AC)
- Privileges Required (PR)
- User Interaction (UI)
Impact metrics:
- Confidentiality Impact (C)
- Integrity Impact (I)
- Availability Impact (A)
Calculate CVSS:
# 使用CVSS计算器
# 输入指标
# 计算分数
# 确定等级
Business Impact
Assessment Factors:
- Data Sensitivity
- System Criticality
- Business Impact
- Compliance Requirements
Risk Matrix:
低影响 中影响 高影响
高可能性 中 高 严重
中可能性 低 中 高
低可能性 低 低 中
Report Writing
Report Structure
Executive Summary:
- Assessment Overview
- Key Findings
- Risk Rating
- Recommended Actions
Detailed Findings:
- Vulnerability Description
- Impact Analysis
- Exploitation Steps
- Remediation Recommendations
Appendix:
- Scan Configuration
- Tool Versions
- Reference Links
- Glossary
Report Template
# 漏洞评估报告
## 执行摘要
- 评估时间：2024-01-01
- 评估范围：xxx
- 发现漏洞：xx个
- 严重漏洞：x个
## 漏洞列表
### VULN-001: SQL注入
- 严重性：严重
- CVSS评分：9.8
- 描述：...
- 影响：...
- 修复建议：...
## 总结
...
Best Practices
1. Before Scanning
- Obtain Authorization
- Determine Scope
- Prepare Tools
- Notify Relevant Personnel
2. During Scanning
- Systematic Scanning
- Record Operations
- Verify Vulnerabilities
- Assess Impact
3. After Scanning
- Analyze Results
- Write Report
- Provide Recommendations
- Track Remediation
Precautions
- Obtain Explicit Authorization
- Avoid Impacting the System
- Protect Scan Data
- Report Critical Vulnerabilities Promptly