.

2026-08-22 12:49:53 +02:00 · 2026-01-27 17:35:45 -05:00
commit 2639af6531
176 changed files with 27104 additions and 0 deletions
@@ -0,0 +1,411 @@
+---
+name: vulnerability-scanning
+description: Scan systems and dependencies for CVEs and security vulnerabilities. Use tools like Nessus, OpenVAS, and Qualys to identify and prioritize vulnerabilities. Use when performing security assessments, compliance scanning, or vulnerability management.
+license: MIT
+metadata:
+  author: devops-skills
+  version: "1.0"
+---
+
+# Vulnerability Scanning
+
+Identify and prioritize security vulnerabilities across infrastructure and applications.
+
+## When to Use This Skill
+
+Use this skill when:
+- Performing security assessments
+- Implementing vulnerability management programs
+- Meeting compliance requirements
+- Triaging and prioritizing remediation
+- Scanning infrastructure for known CVEs
+
+## Prerequisites
+
+- Access to scanning tools
+- Network access to targets
+- Appropriate authorization
+
+## Vulnerability Scanning Tools
+
+| Tool | Type | Best For |
+|------|------|----------|
+| Nessus | Commercial | Enterprise scanning |
+| OpenVAS | Open Source | Free alternative |
+| Qualys | Cloud SaaS | Large scale |
+| Nexpose/InsightVM | Commercial | Asset management |
+| Nuclei | Open Source | Template-based |
+
+## OpenVAS Setup
+
+### Docker Deployment
+
+```bash
+# Run OpenVAS container
+docker run -d --name openvas \
+  -p 443:443 \
+  -v openvas-data:/data \
+  greenbone/openvas-scanner
+
+# Access web UI at https://localhost
+# Default credentials: admin/admin
+```
+
+### Scanning Commands
+
+```bash
+# Create target
+omp -u admin -w admin --xml='<create_target>
+  <name>Web Servers</name>
+  <hosts>192.168.1.0/24</hosts>
+</create_target>'
+
+# Create task
+omp -u admin -w admin --xml='<create_task>
+  <name>Weekly Scan</name>
+  <target id="target-uuid"/>
+  <config id="daba56c8-73ec-11df-a475-002264764cea"/>
+</create_task>'
+
+# Start task
+omp -u admin -w admin --xml='<start_task task_id="task-uuid"/>'
+
+# Get results
+omp -u admin -w admin --xml='<get_results task_id="task-uuid"/>'
+```
+
+## Nessus
+
+### API Usage
+
+```python
+import requests
+
+class NessusScanner:
+    def __init__(self, url, access_key, secret_key):
+        self.url = url
+        self.headers = {
+            'X-ApiKeys': f'accessKey={access_key}; secretKey={secret_key}',
+            'Content-Type': 'application/json'
+        }
+    
+    def create_scan(self, name, targets, template='basic'):
+        """Create a new scan."""
+        templates = self.get('/editor/scan/templates')
+        template_uuid = next(
+            t['uuid'] for t in templates['templates'] 
+            if t['name'] == template
+        )
+        
+        payload = {
+            'uuid': template_uuid,
+            'settings': {
+                'name': name,
+                'text_targets': targets,
+                'enabled': True
+            }
+        }
+        return self.post('/scans', payload)
+    
+    def launch_scan(self, scan_id):
+        """Start a scan."""
+        return self.post(f'/scans/{scan_id}/launch')
+    
+    def get_results(self, scan_id):
+        """Get scan results."""
+        return self.get(f'/scans/{scan_id}')
+    
+    def export_report(self, scan_id, format='pdf'):
+        """Export scan report."""
+        payload = {'format': format}
+        response = self.post(f'/scans/{scan_id}/export', payload)
+        file_id = response['file']
+        
+        # Wait for export
+        while True:
+            status = self.get(f'/scans/{scan_id}/export/{file_id}/status')
+            if status['status'] == 'ready':
+                break
+            time.sleep(5)
+        
+        return self.get(f'/scans/{scan_id}/export/{file_id}/download')
+    
+    def get(self, path):
+        response = requests.get(f'{self.url}{path}', headers=self.headers, verify=False)
+        return response.json()
+    
+    def post(self, path, data=None):
+        response = requests.post(f'{self.url}{path}', json=data, headers=self.headers, verify=False)
+        return response.json()
+
+# Usage
+scanner = NessusScanner('https://nessus:8834', 'access-key', 'secret-key')
+scan = scanner.create_scan('Weekly Infrastructure Scan', '10.0.0.0/24')
+scanner.launch_scan(scan['scan']['id'])
+```
+
+## Nuclei
+
+### Installation
+
+```bash
+# Install nuclei
+go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
+
+# Or download binary
+wget https://github.com/projectdiscovery/nuclei/releases/latest/download/nuclei_linux_amd64.zip
+unzip nuclei_linux_amd64.zip
+```
+
+### Basic Scanning
+
+```bash
+# Update templates
+nuclei -update-templates
+
+# Scan single target
+nuclei -u https://example.com
+
+# Scan multiple targets
+nuclei -l targets.txt
+
+# Scan with specific templates
+nuclei -u https://example.com -t cves/
+nuclei -u https://example.com -t vulnerabilities/
+
+# Scan with severity filter
+nuclei -u https://example.com -s critical,high
+
+# Output formats
+nuclei -u https://example.com -o results.txt
+nuclei -u https://example.com -json -o results.json
+```
+
+### Custom Templates
+
+```yaml
+# custom-check.yaml
+id: custom-admin-panel
+
+info:
+  name: Admin Panel Detection
+  author: security-team
+  severity: info
+  tags: recon,panel
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/admin"
+      - "{{BaseURL}}/administrator"
+      - "{{BaseURL}}/wp-admin"
+    
+    matchers-condition: or
+    matchers:
+      - type: word
+        words:
+          - "admin"
+          - "login"
+        condition: and
+      
+      - type: status
+        status:
+          - 200
+          - 301
+          - 302
+```
+
+## CVSS Scoring
+
+### Severity Levels
+
+| Score | Rating | Response Time |
+|-------|--------|---------------|
+| 9.0-10.0 | Critical | 24 hours |
+| 7.0-8.9 | High | 7 days |
+| 4.0-6.9 | Medium | 30 days |
+| 0.1-3.9 | Low | 90 days |
+
+### Prioritization Factors
+
+```yaml
+prioritization_criteria:
+  critical_factors:
+    - Internet-facing systems
+    - Systems with sensitive data
+    - Active exploitation in the wild
+    - Authentication bypass
+    
+  high_factors:
+    - Remote code execution
+    - Privilege escalation
+    - Data exfiltration risk
+    
+  context_adjustments:
+    - Compensating controls in place (-1)
+    - No direct exposure (-1)
+    - Critical business system (+1)
+    - Compliance requirement (+1)
+```
+
+## Vulnerability Management Process
+
+### Workflow
+
+```yaml
+vulnerability_workflow:
+  discovery:
+    - Run scheduled scans
+    - Import third-party findings
+    - Correlate with asset inventory
+    
+  analysis:
+    - Validate findings
+    - Remove false positives
+    - Assess business impact
+    - Prioritize by risk score
+    
+  remediation:
+    - Assign to owners
+    - Track SLA compliance
+    - Verify fixes
+    - Document exceptions
+    
+  reporting:
+    - Executive summaries
+    - Technical details
+    - Trend analysis
+    - Compliance metrics
+```
+
+### Tracking Template
+
+```markdown
+## Vulnerability Ticket
+
+**ID:** VULN-2024-001
+**CVE:** CVE-2024-12345
+**CVSS:** 9.8 (Critical)
+**Affected System:** web-server-01
+
+### Description
+Remote code execution vulnerability in Apache Struts.
+
+### Impact
+Attacker can execute arbitrary code on the server.
+
+### Remediation
+1. Update Apache Struts to version 2.5.33
+2. Apply WAF rule as temporary mitigation
+
+### Timeline
+- Discovered: 2024-01-15
+- SLA Due: 2024-01-16
+- Remediated: 2024-01-15
+
+### Evidence
+- Scan report: [link]
+- Screenshot: [link]
+```
+
+## CI/CD Integration
+
+### GitHub Actions
+
+```yaml
+name: Vulnerability Scan
+
+on:
+  schedule:
+    - cron: '0 2 * * *'
+  push:
+    branches: [main]
+
+jobs:
+  scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Run Nuclei
+        uses: projectdiscovery/nuclei-action@main
+        with:
+          target: https://example.com
+          templates: cves/
+          output: nuclei-results.txt
+
+      - name: Check for critical findings
+        run: |
+          if grep -q "critical" nuclei-results.txt; then
+            echo "Critical vulnerabilities found!"
+            exit 1
+          fi
+
+      - name: Upload results
+        uses: actions/upload-artifact@v4
+        with:
+          name: vulnerability-report
+          path: nuclei-results.txt
+```
+
+## Compliance Scanning
+
+### CIS Benchmark Scan
+
+```bash
+# Using OpenSCAP
+oscap xccdf eval \
+  --profile xccdf_org.ssgproject.content_profile_cis \
+  --results results.xml \
+  --report report.html \
+  /usr/share/xml/scap/ssg/content/ssg-ubuntu2204-ds.xml
+```
+
+### PCI DSS Scanning
+
+```yaml
+pci_scan_requirements:
+  quarterly:
+    - External vulnerability scan (ASV)
+    - Internal vulnerability scan
+    
+  after_changes:
+    - Significant infrastructure changes
+    - New system deployments
+    
+  passing_criteria:
+    - No vulnerabilities rated 4.0+ (CVSS)
+    - False positives documented
+    - Scan completed within 90 days
+```
+
+## Common Issues
+
+### Issue: False Positives
+**Problem**: Scanner reports non-existent vulnerabilities
+**Solution**: Validate manually, tune scanner, maintain exception list
+
+### Issue: Incomplete Coverage
+**Problem**: Not all assets scanned
+**Solution**: Update asset inventory, verify credentials, check network access
+
+### Issue: Scan Impact
+**Problem**: Scans affecting production systems
+**Solution**: Schedule during maintenance windows, use authenticated scans
+
+## Best Practices
+
+- Maintain accurate asset inventory
+- Schedule regular scan cadence
+- Validate findings before remediation
+- Track metrics (MTTR, aging)
+- Integrate with ticketing systems
+- Document exceptions properly
+- Use risk-based prioritization
+- Automate where possible
+
+## Related Skills
+
+- [sast-scanning](../sast-scanning/) - Code analysis
+- [container-scanning](../container-scanning/) - Container security
+- [cis-benchmarks](../../hardening/cis-benchmarks/) - Compliance benchmarks