Basic Vulnerability Identification Techniques

Vulnerability identification is the process of examining a target environment to identify exploitable weaknesses. These weaknesses can occur in network services, operating systems, or applications. Before you can exploit anything, you need to know what is there and what is wrong with it.

This phase is distinct from both reconnaissance and exploitation. Reconnaissance is about collecting information about the target, such as IP ranges, domain names, and publicly exposed infrastructure. Exploitation is the act of leveraging a confirmed weakness to achieve a specific outcome. Vulnerability identification sits between the two.

An attacker who skips straight from a port scan to running an exploit is guessing. Without knowing what software a target is running, how it is configured, and what version it is at, there is no rational basis for choosing an attack path. A methodical approach to vulnerability identification removes that guesswork and gives you a clear picture of where a target is weak before you commit to an exploitation strategy.

The techniques covered here follow that methodology from start to finish. You will begin by mapping the attack surface of a target environment, then enumerate services and extract version information. From there, you will cross-reference those versions against public vulnerability databases, probe a web application for common flaw classes, and test system-level services for misconfigurations. A practical challenge at the end brings all of these techniques together against a single machine.

Learning Objectives

By the end of this room, you will be able to:

• Explain what vulnerability identification means and where it fits in the offensive security methodology
• Enumerate an environment's attack surface, including open ports, exposed services, and input vectors
• Identify common vulnerability classes across networks, operating systems, and web applications
• Use Nmap and browser developer tools to interrogate target behaviour
• Interpret service banners, error messages, and application responses to assess exploitability
• Triage findings by potential impact and decide which warrant further investigation

Prerequisites

You should be comfortable with the following before starting:

• Basic networking concepts, including TCP/IP, ports, and the client-server model
• Navigating the Linux command line and running tools from a terminal
• Common services such as HTTP, SSH, FTP, and SMB

Machine Access

Launch the AttackBox using the Start AttackBox button, and the Target machine using the Start Machine button below.

Set up your virtual environment

To successfully complete this room, you'll need to set up your virtual environment. This involves starting both your AttackBox (if you're not using your VPN) and Target Machines, ensuring you're equipped with the necessary tools and access to tackle the challenges ahead.

Attacker machine

Status:Off

Target machine

Status:Off

Start Machine