i
Search icon

Website Penetration Testing

Self Learning   /   Study Material   /   Phases Of Vulnerability Assessment
Previous
Next

Phases Of Vulnerability Assessment

There is a method to perform a vulnerability assessment. In this method there are six phases which are used to find the vulnerability in proper manner.

  1. Scoping:-Scoping is the primary step of any security assessment activity. In order to execute a vulnerability assessment the first step is to identify the scope of the assessment in terms of infrastructure against which the assessment is to be conducted, for example, servers,network devices, security devices, databases, and applications.

  2. Information gathering:- Information gathering is second and most important phase of vulnerability assessment. in this phase we try to find the more information of our target system using technical and non-technical method. It helps in getting a better picture of target system. By using this method we find the actual topology of network,server type and its version,running services. Example https://punkspider.org.cutestat.com you can put target website url and see the details given by this site.

  3. Vulnerability scanning:-This stage involves the actual scanning of the target infrastructure to identify existing vulnerabilities of the system. This is done using vulnerability scanners such as Nessus, NMAP Prior to scanning, the tool should be configured optimally as per the target infrastructure information captured during the initial phases. When we have enough information about target then we go for vulnerability scanning. In which we find the vulnerabilities of current network,server,device,database of the target.

  4. False positive analysis:-As an output of the scanning phase, one would obtain a list of vulnerabilities of the target infrastructure. One of the key activities to be performed with the output would be false positive analysis, that is, removing any vulnerability that is falsely reported by the tool and does not exist in reality.

  5. Vulnerability exploitation:-In case system owners require proof of existing vulnerabilities or exploits to understand the extent to which an attacker can compromise a vulnerable system, testers will be required to demonstrate exploits in a controlled environment with out actually making the infrastructure unavailable, unless that’s a requirement. In this phase tester exploit the vulnerability using proper process.

  6. Report generation:- This is the last phase of vulnerability assessment. In which tester make a brief report of all above phase and cover each and every point of assessment.

 

© All rights Reserved | SelfLearning.io