CoreQ Academy3.1 Given a scenario, conduct vulnerability discovery using various techniques.
Different targets need different scans. Choose the scan type and tool that fit the asset, and tune for safety and accuracy.
Container and application scans
- Container scans
- Checking container images and running containers for vulnerable packages and misconfigurations.
- Sidecar scans
- A helper container running alongside the workload in the same pod to inspect it at runtime.
- Application scans
- Testing application code or running apps for flaws.
- Dynamic application security testing (DAST)
- Testing a running app from outside by sending crafted requests.
- Interactive application security testing (IAST)
- Instrumentation inside the running app watches how test traffic flows through code, giving precise findings.
- Software composition analysis (SCA)
- Identifying third-party libraries and their known vulnerabilities and licences.
- Static application security testing (SAST)
- Analysing source or binaries without running them.
- Infrastructure as Code (IaC)
- Scanning Terraform, CloudFormation or Kubernetes manifests for insecure settings before deployment.
- Source code analysis
- Reviewing source for vulnerable patterns, manually or with tools.
- Mobile scan
- Static and dynamic analysis of mobile app packages.
Network, host and wireless scans
- Network scans
- Discovering hosts, ports and vulnerable services across networks.
- TCP/UDP scan
- Probing TCP and UDP ports for open services.
- Stealth scans
- Techniques such as SYN (half-open) scans that avoid completing connections, reducing log noise.
- Host-based scans
- Agent or local scans that see installed packages and configuration.
- Authenticated vs. unauthenticated scans
- Authenticated (credentialed) scans log in and find far more, with fewer false positives; unauthenticated scans show the outsider view.
- Secrets scanning
- Searching code, history and storage for exposed credentials.
- Wireless
- Assessing wireless networks.
- Service set identifier (SSID) scanning
- Listing visible network names, including rogue or misconfigured ones.
- Channel scanning
- Checking which channels are used and congested.
- Signal strength scanning
- Measuring how far signals reach, including outside the building.
Industrial control systems (ICS) vulnerability assessment
- Industrial control systems (ICS) vulnerability assessment
- Assessing OT environments with extra caution because active scans can crash controllers.
- Manual assessment
- Reviewing configurations, firmware versions and architecture by hand instead of active scanning.
- Port mirroring
- Copying traffic to a monitoring port for passive analysis without touching fragile devices.
Tools
- Nikto
- Web server scanner for dangerous files, outdated software and misconfigurations.
- Greenbone/Open Vulnerability Assessment Scanner (OpenVAS)
- Open-source network vulnerability scanner.
- TruffleHog
- Finds secrets in Git history, files and cloud storage.
- BloodHound
- Maps Active Directory and Entra ID relationships to reveal attack paths to privileged accounts.
- Tenable Nessus
- Widely used commercial vulnerability scanner.
- PowerSploit
- PowerShell post-exploitation and reconnaissance modules (now archived but still referenced).
- Grype
- Scans container images and filesystems for known vulnerable packages.
- Trivy
- Scans images, filesystems, repos, IaC and Kubernetes for vulnerabilities, misconfigurations and secrets.
- Kube-hunter
- Hunts for security weaknesses in Kubernetes clusters.
Check your understanding
Loading quiz…
Original CoreQ Academy material, mapped to objective 3.1 of the publicly available CompTIA PenTest+ PT0-003 exam objectives (Exam objectives V3, document version 5.0). Not affiliated with or endorsed by CompTIA. Contains no exam questions.