---

name: vulnerability-scanning description: Scan systems and dependencies for CVEs and security vulnerabilities. Use tools like Nessus, OpenVAS, and Qualys to identify and prioritize vulnerabilities. Use when performing security assessments, compliance scanning, or vulnerability management. license: MIT metadata: author: devops-skills version: "1.0"

Vulnerability Scanning

Identify and prioritize security vulnerabilities across infrastructure and applications.

When to Use This Skill

Use this skill when:

• Performing security assessments
• Implementing vulnerability management programs
• Meeting compliance requirements
• Triaging and prioritizing remediation
• Scanning infrastructure for known CVEs

Prerequisites

• Access to scanning tools
• Network access to targets
• Appropriate authorization

Vulnerability Scanning Tools

Tool	Type	Best For
Nessus	Commercial	Enterprise scanning
OpenVAS	Open Source	Free alternative
Qualys	Cloud SaaS	Large scale
Nexpose/InsightVM	Commercial	Asset management
Nuclei	Open Source	Template-based

OpenVAS Setup

Docker Deployment

# Run OpenVAS container
docker run -d --name openvas \
  -p 443:443 \
  -v openvas-data:/data \
  greenbone/openvas-scanner

# Access web UI at https://localhost
# Default credentials: admin/admin

Scanning Commands

# Create target
omp -u admin -w admin --xml='<create_target>
  <name>Web Servers</name>
  <hosts>192.168.1.0/24</hosts>
</create_target>'

# Create task
omp -u admin -w admin --xml='<create_task>
  <name>Weekly Scan</name>
  <target id="target-uuid"/>
  <config id="daba56c8-73ec-11df-a475-002264764cea"/>
</create_task>'

# Start task
omp -u admin -w admin --xml='<start_task task_id="task-uuid"/>'

# Get results
omp -u admin -w admin --xml='<get_results task_id="task-uuid"/>'

Nessus

API Usage

import requests

class NessusScanner:
    def __init__(self, url, access_key, secret_key):
        self.url = url
        self.headers = {
            'X-ApiKeys': f'accessKey={access_key}; secretKey={secret_key}',
            'Content-Type': 'application/json'
        }
    
    def create_scan(self, name, targets, template='basic'):
        """Create a new scan."""
        templates = self.get('/editor/scan/templates')
        template_uuid = next(
            t['uuid'] for t in templates['templates'] 
            if t['name'] == template
        )
        
        payload = {
            'uuid': template_uuid,
            'settings': {
                'name': name,
                'text_targets': targets,
                'enabled': True
            }
        }
        return self.post('/scans', payload)
    
    def launch_scan(self, scan_id):
        """Start a scan."""
        return self.post(f'/scans/{scan_id}/launch')
    
    def get_results(self, scan_id):
        """Get scan results."""
        return self.get(f'/scans/{scan_id}')
    
    def export_report(self, scan_id, format='pdf'):
        """Export scan report."""
        payload = {'format': format}
        response = self.post(f'/scans/{scan_id}/export', payload)
        file_id = response['file']
        
        # Wait for export
        while True:
            status = self.get(f'/scans/{scan_id}/export/{file_id}/status')
            if status['status'] == 'ready':
                break
            time.sleep(5)
        
        return self.get(f'/scans/{scan_id}/export/{file_id}/download')
    
    def get(self, path):
        response = requests.get(f'{self.url}{path}', headers=self.headers, verify=False)
        return response.json()
    
    def post(self, path, data=None):
        response = requests.post(f'{self.url}{path}', json=data, headers=self.headers, verify=False)
        return response.json()

# Usage
scanner = NessusScanner('https://nessus:8834', 'access-key', 'secret-key')
scan = scanner.create_scan('Weekly Infrastructure Scan', '10.0.0.0/24')
scanner.launch_scan(scan['scan']['id'])

Nuclei

Installation

# Install nuclei
go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest

# Or download binary
wget https://github.com/projectdiscovery/nuclei/releases/latest/download/nuclei_linux_amd64.zip
unzip nuclei_linux_amd64.zip

Basic Scanning

# Update templates
nuclei -update-templates

# Scan single target
nuclei -u https://example.com

# Scan multiple targets
nuclei -l targets.txt

# Scan with specific templates
nuclei -u https://example.com -t cves/
nuclei -u https://example.com -t vulnerabilities/

# Scan with severity filter
nuclei -u https://example.com -s critical,high

# Output formats
nuclei -u https://example.com -o results.txt
nuclei -u https://example.com -json -o results.json

Custom Templates

# custom-check.yaml
id: custom-admin-panel

info:
  name: Admin Panel Detection
  author: security-team
  severity: info
  tags: recon,panel

requests:
  - method: GET
    path:
      - "{{BaseURL}}/admin"
      - "{{BaseURL}}/administrator"
      - "{{BaseURL}}/wp-admin"
    
    matchers-condition: or
    matchers:
      - type: word
        words:
          - "admin"
          - "login"
        condition: and
      
      - type: status
        status:
          - 200
          - 301
          - 302

CVSS Scoring

Severity Levels

Score	Rating	Response Time
9.0-10.0	Critical	24 hours
7.0-8.9	High	7 days
4.0-6.9	Medium	30 days
0.1-3.9	Low	90 days

Prioritization Factors

prioritization_criteria:
  critical_factors:
    - Internet-facing systems
    - Systems with sensitive data
    - Active exploitation in the wild
    - Authentication bypass
    
  high_factors:
    - Remote code execution
    - Privilege escalation
    - Data exfiltration risk
    
  context_adjustments:
    - Compensating controls in place (-1)
    - No direct exposure (-1)
    - Critical business system (+1)
    - Compliance requirement (+1)

Vulnerability Management Process

Workflow

vulnerability_workflow:
  discovery:
    - Run scheduled scans
    - Import third-party findings
    - Correlate with asset inventory
    
  analysis:
    - Validate findings
    - Remove false positives
    - Assess business impact
    - Prioritize by risk score
    
  remediation:
    - Assign to owners
    - Track SLA compliance
    - Verify fixes
    - Document exceptions
    
  reporting:
    - Executive summaries
    - Technical details
    - Trend analysis
    - Compliance metrics

Tracking Template

## Vulnerability Ticket

**ID:** VULN-2024-001
**CVE:** CVE-2024-12345
**CVSS:** 9.8 (Critical)
**Affected System:** web-server-01

### Description
Remote code execution vulnerability in Apache Struts.

### Impact
Attacker can execute arbitrary code on the server.

### Remediation
1. Update Apache Struts to version 2.5.33
2. Apply WAF rule as temporary mitigation

### Timeline
- Discovered: 2024-01-15
- SLA Due: 2024-01-16
- Remediated: 2024-01-15

### Evidence
- Scan report: [link]
- Screenshot: [link]

CI/CD Integration

GitHub Actions

name: Vulnerability Scan

on:
  schedule:
    - cron: '0 2 * * *'
  push:
    branches: [main]

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Run Nuclei
        uses: projectdiscovery/nuclei-action@main
        with:
          target: https://example.com
          templates: cves/
          output: nuclei-results.txt

      - name: Check for critical findings
        run: |
          if grep -q "critical" nuclei-results.txt; then
            echo "Critical vulnerabilities found!"
            exit 1
          fi

      - name: Upload results
        uses: actions/upload-artifact@v4
        with:
          name: vulnerability-report
          path: nuclei-results.txt

Compliance Scanning

CIS Benchmark Scan

# Using OpenSCAP
oscap xccdf eval \
  --profile xccdf_org.ssgproject.content_profile_cis \
  --results results.xml \
  --report report.html \
  /usr/share/xml/scap/ssg/content/ssg-ubuntu2204-ds.xml

PCI DSS Scanning

pci_scan_requirements:
  quarterly:
    - External vulnerability scan (ASV)
    - Internal vulnerability scan
    
  after_changes:
    - Significant infrastructure changes
    - New system deployments
    
  passing_criteria:
    - No vulnerabilities rated 4.0+ (CVSS)
    - False positives documented
    - Scan completed within 90 days

Common Issues

Issue: False Positives

Problem: Scanner reports non-existent vulnerabilities Solution: Validate manually, tune scanner, maintain exception list

Issue: Incomplete Coverage

Problem: Not all assets scanned Solution: Update asset inventory, verify credentials, check network access

Issue: Scan Impact

Problem: Scans affecting production systems Solution: Schedule during maintenance windows, use authenticated scans

Best Practices

• Maintain accurate asset inventory
• Schedule regular scan cadence
• Validate findings before remediation
• Track metrics (MTTR, aging)
• Integrate with ticketing systems
• Document exceptions properly
• Use risk-based prioritization
• Automate where possible

Related Skills

• sast-scanning - Code analysis
• container-scanning - Container security
• cis-benchmarks - Compliance benchmarks