Overview

  • Divided into two areas, one is scanning for known vulns. The other is analyzing the results to determine a path forward
  • Analysis can be broken down further into
    • Descriptive - describes data set based on characteristics
    • Diagnostic - ex. reviewing data to determine root cause of vulnerability
    • Predictive - evaluating historical and current data to determine future probabilities or detect trends
    • Prescriptive - narrow down what actions to take to eliminate a problem or trigger a certain action

Finding Vulnerabilities

There are manual methods and automated methods in finding vulnerabilites. For the OSCP, automated methods are forbidden

Automated Scanning

# nmap version detection can fingerprint versions on open ports for use in finding vulnerabilities
nmap -sV <target-ip> -oA <output>

# web vuln scan
nikto -h http://<target> -o output.txt

Finding Exploits

# install command for searchsploit
sudo apt install exploitdb -y

# finding available PoCs for an app with searchsploit
searchsploit -www <appname> <version>
searchsploit openssh 7.2

# searching via metasploit
msfconsole
msf6 > search exploit <name>

OWASP Top 10

The Open Worldwide Application Security Project (OWASP) keeps a top 10 list of the most prominent attack vectors in applications.

The 2025 OWASP Top 10 List

  • A01: Broken Access Control: Users can act outside their intended permissions or view other people's data.
  • A02: Security Misconfiguration: Insecure default settings, open cloud storage, or verbose error messages.
  • A03: Software Supply Chain Failures: Compromised third-party packages, dependencies, or build pipelines.
  • A04: Cryptographic Failures: Weak encryption algorithms or storing sensitive data in plain text.
  • A05: Injection: Untrusted input sent to an interpreter as code, such as SQL injection.
  • A06: Insecure Design: Flaws in the application's core architecture or missing threat modeling.
  • A07: Authentication Failures: Weak passwords, bad session management, or broken login flows.
  • A08: Software or Data Integrity Failures: Trusting updates or plugins without verifying digital signatures.
  • A09: Security Logging and Alerting Failures: Not recording critical security events or failing to spot attacks.
  • A10: Mishandling of Exceptional Conditions: Improper handling of system errors, crashes, or resource limits.