Vulnerability Scanning Tools | TryHackMe (THM)

→ Room Link ←

Task 1 → Introduction

Vulnerability scanning is an automated process that identifies weaknesses, misconfigurations, and potential security issues across systems, networks, web applications, and devices. It's usually one of the first steps in a penetration test or security assessment.

Learning Objectives

• Understand what vulnerability scanning is and why it is crucial for securing systems and networks
• Learn key concepts, including vulnerabilities, CVEs, CVSS, and common types of scanners
• Gain practical skills using Nmap, OpenVAS, and Nikto to identify and analyse vulnerabilities
• Develop the ability to interpret scan results and understand their security impact
• Learn best practices for performing safe, effective, and ethical vulnerability scans

Prerequisites

You should have a better understanding of the following rooms before starting:

• Networking Core Protocols
• Networking Essentials
• Web Application Basics

Machine Access

Start the machine by clicking the Start Lab Machine button below. It will take approximately 2–3 minutes for the system to load. Once ready, the VM will open in split view mode, giving you access to both the lab environment and the tools you'll need.

Answer the questions below

I can successfully start the machine.

No answer needed

Task 2 → Important Topics

In this task, the basic terminology used in vulnerability assessment will be reviewed. The goal is to build a clear understanding of core concepts, including vulnerabilities, CVEs, CVSS scores, and common scanner types. This foundational knowledge will support the practical scanning activities in the upcoming tasks.

Core Terminology

Vulnerability

A vulnerability is a weakness or flaw in a system that could be exploited to bypass security or gain unauthorised access. It may result from outdated software, poor configuration, or design mistakes. For example, like a door with a broken lock that anyone can open, even though it's supposed to stay secure.

Common Vulnerabilities and Exposures (CVE)

A CVE is a unique identification number assigned to a publicly known security flaw, enabling consistent tracking across various tools and databases. It helps security teams quickly reference and research the issue. For example, similar to a product recall number for a faulty car part, but applied to software vulnerabilities.

Common Vulnerability Scoring System (CVSS)

CVSS provides a standardised score (0–10) that measures the severity or risk of a vulnerability based on its impact and exploitability. Higher scores indicate issues that require urgent attention. For example, much like weather alerts that classify storms as mild, moderate, or severe.

Misconfiguration

A misconfiguration occurs when a system or service is set up incorrectly, creating unnecessary security weaknesses. These issues often arise from default settings, open permissions, or a lack of hardening. For example, leaving a Wi-Fi network protected with a password like "123456".

Software Vulnerability

A software vulnerability is a flaw in an application's code or logic that allows unintended behaviour or exploitation. These weaknesses often require developers to apply patches or updates. For example, a calculator app that crashes or behaves strangely when certain inputs are entered.

Types of Vulnerability Scanners

Network Scanner

A network scanner examines devices on a network to identify open ports, running services, and possible exposure points. It helps map out what systems are accessible and where risks may exist. For example, walking down a street and checking which doors or windows are unlocked.

Web Application Scanner

A web application scanner analyses websites or web apps for security issues, including outdated components, weak configurations, or risky behaviours. It focuses specifically on the HTTP/HTTPS layer. For example, testing a login form to see if it accepts weak or unexpected inputs.

Host-Based Scanner

A host-based scanner runs directly on a system to check for missing patches, outdated software, and insecure configuration settings. It provides a detailed view of internal system health. For example, similar to an antivirus that reviews installed programs for known issues, not just malware.

Output of a Scanning Report

• Include the severity level, indicating how serious the issue is
• Detected services and version information
• Related CVEs or known risks
• Recommended fixes or mitigation steps

Answer the questions below

Question: What is the maximum range for a CVSS score?

Answer: 10

Question: What is a scanner called that examines devices on a network to identify open ports and running services?

Answer: Network Scanner

Task 3 → Nmap

Network Mapper (Nmap) is a widely used network scanning tool that discovers hosts, identifies open ports, and determines which services are running on systems. It plays a key role in the early stages of vulnerability assessment by helping analysts understand what is exposed on a network. Before any vulnerability can be tested or exploited, Nmap is used to map the attack surface and gather essential information about the target environment.

Scanning the Environment

In this practical section, the attached VM will serve as the target environment. Open the terminal on your AttackBox or local machine and perform Nmap scans against the provided 10.114.165.161. As a pentester, your task is to enumerate this single IP address just as you would during an initial assessment. The following steps will guide you through host discovery, port scanning, service detection, and basic vulnerability identification using Nmap.

Host Discovery

Host discovery determines which devices on a network are active and responding. This step helps build a list of live systems to focus on before deeper scanning. In the attached VM, open the terminal and execute the command nmap -sn 10.114.165.161:

In the output above, Nmap confirms that the lab machine at 10.114.165.161 is active and responding to probes. Since this is a host-only discovery scan, no ports or services are checked; Nmap reports whether the system is reachable. This step verifies that the machine is online before moving on to deeper enumeration.

Port Scanning

Port scanning identifies which ports are open and what communication pathways are available. Open ports often reveal running services that may contain vulnerabilities or misconfigurations. In the attached VM, run the command nmap -sV 10.114.165.161:

In the output above, Nmap discovers four open and active services on the target system: FTP (21), SSH (22), an HTTP service running through WebSockify on port 80, and a VNC service on port 5901. These exposed services reveal how the machine communicates externally and indicate potential entry points for attackers. The scan also detects service versions, which are important because outdated or misconfigured versions may contain known vulnerabilities.

Aggressive Scan

An aggressive scan performs deeper enumeration, including OS detection, service versions, running scripts, and traceroute. It provides far more detailed information than basic scans, but it also generates louder, more noticeable traffic. This scan simulates a more thorough early-stage assessment performed during penetration testing. In the attached VM, issue the command nmap -A 10.114.165.161:

In the output above, Nmap's aggressive scan reveals detailed information about the target, including open ports, service versions, SSH keys, and HTTP banner data. The scan also performs OS detection and runs extra scripts to gather deeper insight into each service. This helps build a clearer understanding of the machine's attack surface beyond basic port scanning.

Vulnerability Scanning via NSE

Nmap includes the Nmap Scripting Engine (NSE), a powerful framework that automates vulnerability checks. NSE scripts can test for common issues, weak configurations, outdated services, and more, enabling Nmap to perform lightweight vulnerability assessments.

The Nmap Scripting Engine allows Nmap to run specialised scripts written in Lua to extend its functionality. These scripts can perform tasks such as brute-force attempts, version checks, protocol analysis, and basic vulnerability detection. NSE makes Nmap more than just a port scanner; it becomes a flexible tool for in-depth exploration and early security assessment.

In the above terminal, the Nmap ftp-anon NSE script was used to test anonymous authentication on the FTP service running on port 21. The scan confirms that the FTP server is online and responding normally. The script reports Anonymous FTP login allowed (FTP code 230), indicating that the server grants unauthenticated users access. This represents a security risk, as anyone can log in without credentials and potentially view or download exposed files. Anonymous FTP access should be disabled unless explicitly required.

Answer the questions below

Question: What is the FTP port number on the lab machine?

Answer: 21

Question: What service is running on port 80 on the lab machine?

Answer: WebSockify

Question: What is the name of the scripting engine that allows Nmap to run specialised scripts written in Lua to extend its functionality?

Answer: Nmap Scripting Engine

Task 4 → Nikto Web Scanner

Nikto is a widely used web server vulnerability scanner that identifies insecure configurations, outdated components, and common web-based weaknesses. It performs a comprehensive scan of a target web server and checks it against thousands of known issues, including default files, dangerous HTTP methods, misconfigurations, and potential security exposures. While Nikto is not a stealthy tool, it is extremely effective during early web vulnerability assessments where thoroughness is more important than evasion. Before moving into deeper application-layer testing, Nikto helps determine whether the web server itself introduces weaknesses that attackers could exploit.

Scanning the Environment

In this practical step, we will scan the vulnerable web application running on port 5000, as shown below:

Using Nikto, we'll identify misconfigurations, exposed files, and other common weaknesses. Begin the assessment in the target environment by running the following command nikto -h ``[http://10.114.165.161:8080](http://10.114.165.161:8080:):

Understanding the Nikto Scan Results

After running Nikto against the target web application, the scanner identifies several issues related to insecure configurations, unnecessary information exposure, and web server misconfigurations. These findings highlight potential entry points attackers might explore. Below is a breakdown of the results and what each item means in practical terms.

• Web Server Information Disclosure (Server: Apache/2.4.58): Nikto detects the exact server version, which helps attackers look up known vulnerabilities for that version. Ideally, servers should limit the amount of version information to reduce unnecessary exposure.
• Cookie Missing Security Flags (PHPSESSID created without the HttpOnly flag): This means the cookie can be accessed via client-side scripts, increasing the risk of session hijacking. Secure applications normally set both the HttpOnly and Secure flags on cookies used to handle session data.
• Missing Clickjacking Protection (X-Frame-Options header not present): Without this header, the site can be embedded in an iframe, enabling "clickjacking" attacks that trick users into clicking hidden elements.
• Potentially Dangerous HTTP Method (DEBUG HTTP verb available): Some servers respond to uncommon methods, such as DEBUG, which can reveal internal debugging information. This is unnecessary for normal operation and should be disabled to reduce information leakage.
• Exposed PHP Info Page (/info.php found running phpinfo()): The phpinfo() output reveals extensive system information, modules, configuration values, and environment variables and is commonly removed in production environments. Leaving it accessible introduces high information leakage risks.
• Directory Indexing Enabled (/static/ directory indexing): This allows anyone to browse the contents of a directory without restriction, revealing files that shouldn't be publicly visible. Directory listing should be disabled unless absolutely required.
• Remote File Inclusion (RFI) Test Detected (info.php?file=<external_link>): Nikto detected a parameter that may be vulnerable to Remote File Inclusion if mishandled. RFI vulnerabilities allow attackers to load code from external servers and execute it on the target system, one of the most severe web risks.

Overall Assessment

Nikto reports 7 notable issues out of 6,544 checks, indicating the web server has several misconfigurations and unnecessary exposures. While none of these findings alone guarantees exploitation, they significantly increase the attack surface. Many of these issues exposed status pages, missing headers, and directory indexing, and are configuration-related and can be fixed quickly through proper hardening.

Answer the questions below

Question: What is the Apache Server version?

Answer: 2.4.58

Question: Per the Nikto report, which flag is missing from the cookie in the web app?

Answer: Httponly

Before starting a Nikto scan, we need to know which port the HTTP server is actually running on — because Nikto scans a specific port, and if you scan the wrong one, you'll get misleading or irrelevant results (like we saw with port 80 showing WebSockify instead of Apache).

After getting the port number, we can start to scan our lab machine and see the missing flag.

Question: What is the name of the directory with directory listing enabled?

Answer: static

Question: What is the parameter vulnerable to RFI?

Answer: file

Task 5 → OpenVAS & Greenbone Vulnerability Management

Now we will use OpenVAS, a powerful vulnerability scanner that assesses both host-level weaknesses and web application security issues. It provides deep, authenticated and unauthenticated scanning, making it ideal for identifying misconfigurations, outdated software, missing patches, and exposed services.

In the attached VM, OpenVAS is already running in the background. Open Firefox and navigate to the URL http://127.0.0.1:9392 to access the Greenbone Security Assistant web dashboard. You will be greeted with the login screen.

Enter the default credentials admin:admin to log in and begin exploring the vulnerability scanning features. You will see the following screen after logging in.

Adding a Target

Before running any scan, OpenVAS requires a target to be defined. Navigate to Configuration > Targets, click the Plus (+) icon, and enter the target name SecondTarget and the IP MACHINE_IP. Once the details are filled in, click Save to register the target for scanning, as shown below:

Scanning a Target

After adding a target, the next step is to create a scan task. Go to Scans > Tasks, click the Plus (+) icon, and choose New Task. Enter the task name SecondTask and select the target you added earlier, keep the default scan configuration, and click Save to create the task. Once created, click the Run button to begin the vulnerability scan. OpenVAS will analyse the host and display real-time progress until the scan completes.

Note: You won't be able to run a scan in the VM as it requires an active internet connection to sync the feeds. Scans may also take 20–25 minutes to complete. To help you answer the questions in this task, a pre-scanned task named MyTarget has already been generated in Reports..

Viewing the Report

To view the results of the MyTarget report, go to Scans > Reports. Click the report entry for the scan date and time.

This will open a detailed dashboard showing key information, including detected hosts, open ports, identified applications, operating system details, and associated CVEs. You can navigate through each section to explore vulnerabilities and their severity.

Results Tab

In the Results tab, the scan findings are listed by severity level, affected ports, and host details. The report highlights issues such as anonymous FTP access, exposed phpinfo pages, missing cookie protections, and weak encryption settings. Each entry shows when it was detected and provides a quick overview of the risk it poses. This view helps understand exactly which services or configurations introduce vulnerabilities.

CVEs Tab

In the CVEs tab, OpenVAS maps detected issues to known published vulnerabilities. The scan identified several CVEs, including ones related to anonymous FTP access, phpinfo exposure, and ICMP timestamp disclosure.

You can answer the following questions using the MyTarget scan result.

Answer the questions below

Question: What is the severity number for the vulnerablility phpinfo() Output Reporting (HTTP)?

Answer: 5.3

This is how I found it:

On your lab machine enter the OpenVAS login page (http://127.0.0.1:9392/login).

Question: What is the CVE value associated with Anonymous FTP Login Reporting?

Answer: CVE-1999–0497

Question: What is the target Operating System?

Answer: Ubuntu 24.04

This is how I found it:

Task 6 → Best Practices

Now that the earlier tasks introduced multiple vulnerability scanning tools, this section focuses on using them effectively and responsibly. Understanding how to approach scans, interpret results, and avoid common mistakes is essential for conducting safe and reliable assessments. These best practices will help build confidence as you begin performing real scans in practical environments.

• Start Light: Begin with non-intrusive scans to avoid slowing or disrupting the target system, especially in shared or production environments.
• Right Tooling: Match the scanner to the job — use Nmap for network discovery, OpenVAS for deep analysis, and Nikto for web server checks.
• Verify Results: Double-check high-severity findings manually because scanners can produce false positives or incomplete information.
• Stay Updated: Keep scanning tools and vulnerability feeds up to date so the scanner can identify new CVEs and configuration issues.
• Use Credentials: When allowed, run authenticated scans to get more accurate visibility into missing patches and internal weaknesses.
• Compare Over Time: Save scan outputs and compare them regularly to track improvements, detect regressions, and monitor newly introduced issues.
• Scan Smart: Schedule scans during low-traffic hours since vulnerability scanning can consume noticeable network and system resources.

Answer the questions below

I have understood the best practices for using vulnerability scanning tools.

No answer needed

Task 7 → Conclusion

Vulnerability scanning tools play a critical role in modern cyber security by automatically identifying weaknesses, misconfigurations, and outdated software across systems and networks. These tools help pentesters to detect potential attack vectors before adversaries can exploit them, making them essential for maintaining a strong security posture.

In this room, you gained an understanding of vulnerability scanning and its importance in securing networks and systems, covering:

• What vulnerability scanning is and its importance in securing networks and systems.
• What vulnerabilities are, how they are classified, and why identifying them early is essential for reducing security risks.
• Using Nmap, OpenVAS, and Nikto to identify, analyse, and interpret vulnerabilities effectively.
• What the best practices are for performing safe and ethical scans.

Answer the questions below

Great work! You have completed the Vulnerability Scanning Tools room.

No answer needed