Back to Blog

HTB Academy - Vulnerability Assessment Course Notes

Vulnerability Assessment

Security Assessments

Early organization vulnerability assessment first before pentest, because pentest would have many findings and overwhelm the staffs.

Vuln assessment vs Pentest: Vuln assessment -> without cyber attack simulation.

Standards used: GDPR compliance, OWASP Web Security Standards.

test

Jenis security assessments

  • Vulnerability Assessment
  • Pentest
  • Sec Audit
    • Security audits are typically requirements from outside the organization, and they’re typically mandated by government agencies or industry associations to assure that an organization is compliant with specific security regulations.
    • For example, all online and offline retailers, restaurants, and service providers who accept major credit cards (Visa, MasterCard, AMEX, etc.) must comply with the PCI-DSS “Payment Card Industry Data Security Standard”. PCI DSS is a regulation enforced by the Payment Card Industry Security Standards Council, an organization run by credit card companies and financial service industry entities. A company that accepts credit and debit card payments may be audited for PCI DSS compliance, and noncompliance could result in fines and not being allowed to accept those payment methods anymore.
    • Regardless of which regulations an organization may be audited for, it’s their responsibility to perform vulnerability assessments to assure that they’re compliant before they’re subject to a surprise security audit.
  • Bug bounty
    • Invite public, has scope + restriction, then the reporter get paid
    • Good for organization with high security maturity, have their own team to triage, handle bug report
  • Red Team
    • Evasive black box pentesting from 3rd party consulting firms. Contains profesionals with pentest experience. The assessors only report the vulnerabilities that led to the completion of the goal, not as many vulnerabilities as possible as with a penetration test.
  • Purple Team
    • Red + Blue work together with common goal. Red team, but got blue team involved in every step

Vulnerability Assessment

Methodology: ![[Pasted image 20250228190558.png]]

Key terms

  • Vuln
  • Threat
  • Exploit
  • Risk

Assessment Standards

Compliance Standards:

  • PCI DSS
  • HIPAA
  • FISMA
  • ISO 27001

Pentest Standards:

  1. PTES
    • Pre-engagement Interactions
    • Intelligence Gathering
    • Threat Modeling
    • Vulnerability Analysis
    • Exploitation
    • Post Exploitation
    • Reporting
  2. OSSTMM
    1. Human Security (human beings are subject to social engineering exploits)
    2. Physical Security
    3. Wireless Communications (including but not limited to technologies like WiFi and Bluetooth)
    4. Telecommunications
    5. Data Networks
  3. NIST
    • Planning
    • Discovery
    • Attack
    • Reporting
  4. OWASP
    1. Web Sec Testing Guide (WSTG)
    2. Mobile Sec Testing Guide (MSTG)
    3. Firmware Sec Testing Methodology

Vuln Scoring & Reporting

CVSS

CVE

Nessus

OpenVAS

Reporting

A strong report consists of the following sections:

  • Executive Summary: Intended to be readable by an executive who needs a high-level overview of the details and what is the most important items to fix immediately, depending on the severity. You can also include a graphical view of the number of vulnerabilities based on the severity here
  • Overview of Assessment: Include any methodology leveraged during the assessment, detail the execution of the assessment during the testing period, such as discussing the process and tools used for the project (e.g., Nessus).
  • Scope: Include everything the client authorized for the assessment, including the target scope and the testing period.
  • Vulnerabilities and Recommendations: Detail the findings discovered during the vulnerability assessment once you’ve eliminated any false positives. Each issue should have the following elements:
    • Vulnerability Name
    • CVE
    • CVSS
    • Description of Issue
    • References
    • Remediation Steps
    • Proof of Concept
    • Affected Systems

Note: Make sure you are writing your reports such that any audience can read them. Sentences should be to the point with proper grammar as well. The strongest reports are concise and clear for a reader.