Vulnerability Scanning Task - Cybersecurity Internship

Task 3: Basic Vulnerability Scan on Local PC

Overview

This project demonstrates how to perform a basic vulnerability assessment on a local machine using free security scanning tools. This is an educational exercise to understand common vulnerabilities and security risks in personal computing environments.

⚠️ IMPORTANT: This is for educational purposes only. Only scan systems you own or have explicit permission to scan. Unauthorized scanning is illegal.

Objective

Use free vulnerability scanning tools to identify common security weaknesses on your computer and learn how to interpret scan results and prioritize remediation efforts.

Tools Used

• OpenVAS Community Edition - Open-source vulnerability scanner
  • Alternative: Nessus Essentials (free for home use)
• Operating System: [Your OS - Windows/Linux/macOS]
• Python (optional) - For generating custom reports

What's Included

• Vulnerability scan reports (PDF/HTML format)
• Screenshots of scan process and results
• Analysis of critical vulnerabilities found
• Remediation recommendations
• Interview questions with detailed answers

Installation & Setup

Option 1: OpenVAS (Recommended for Linux)

# Install OpenVAS on Ubuntu/Debian
sudo apt update
sudo apt install openvas

# Setup OpenVAS
sudo gvm-setup

# Start OpenVAS services
sudo gvm-start

# Get admin password
sudo gvm-feed-update

Access OpenVAS at: https://localhost:9392

Option 2: Nessus Essentials (Cross-platform)

1. Download from: https://www.tenable.com/products/nessus/nessus-essentials
2. Install the package for your OS
3. Navigate to: https://localhost:8834
4. Register for activation code (free)
5. Complete setup wizard

Scan Configuration

Target Setup

• Target: 127.0.0.1 (localhost) or your local IP address
• Scan Type: Full and thorough scan
• Credentials: Provide local admin credentials for authenticated scan
• Port Range: Default (1-65535) or common ports

Scan Parameters

Scan Name: Local PC Vulnerability Assessment
Target: 127.0.0.1
Scan Policy: Full and thorough
Estimated Time: 30-60 minutes
Date: [Your scan date]

Scan Process

Step 1: Identify Your IP Address

# Linux/macOS
ifconfig | grep inet

# Windows
ipconfig

Step 2: Create New Scan

1. Log into scanner web interface
2. Click "New Scan"
3. Select "Basic Network Scan" or "Host Discovery"
4. Enter target IP: 127.0.0.1
5. Configure scan settings

Step 3: Run the Scan

1. Launch the scan
2. Monitor progress in dashboard
3. Wait for completion (30-60 minutes typical)

Step 4: Review Results

• Navigate to completed scan
• Review vulnerability summary
• Check severity ratings (Critical, High, Medium, Low, Info)
• Export detailed report

Scan Results Summary

Vulnerabilities Found

Severity	Count	Percentage
Critical	X	XX%
High	X	XX%
Medium	X	XX%
Low	X	XX%
Info	X	XX%

Top Critical Vulnerabilities

1. [Vulnerability Name]

   • CVSS Score: X.X
   • CVE ID: CVE-XXXX-XXXX
   • Description: [Brief description]
   • Impact: [What could happen]
   • Remediation: [How to fix]

2. [Vulnerability Name]

   • CVSS Score: X.X
   • CVE ID: CVE-XXXX-XXXX
   • Description: [Brief description]
   • Impact: [What could happen]
   • Remediation: [How to fix]

3. [Vulnerability Name]

   • CVSS Score: X.X
   • CVE ID: CVE-XXXX-XXXX
   • Description: [Brief description]
   • Impact: [What could happen]
   • Remediation: [How to fix]

Common Vulnerabilities Found on Personal Computers

1. Outdated Software

• Operating system patches missing
• Outdated applications with known vulnerabilities
• End-of-life software still in use

2. Weak Passwords

• Default passwords not changed
• Simple or dictionary-based passwords
• No password complexity requirements

3. Missing Security Updates

• Windows Update disabled
• Automatic updates turned off
• Critical patches not applied

4. Unnecessary Services Running

• Unused network services enabled
• Default ports exposed
• Guest accounts active

5. Weak Network Configuration

• Unencrypted protocols (HTTP, FTP, Telnet)
• Open/unrestricted firewall rules
• SMBv1 enabled (vulnerable protocol)

6. Browser Vulnerabilities

• Outdated browser versions
• Insecure plugins/extensions
• No HTTPS enforcement

Remediation Steps

High Priority Actions

1. Update Operating System

   # Windows
   Settings > Update & Security > Windows Update
   
   # Linux (Ubuntu/Debian)
   sudo apt update && sudo apt upgrade
   
   # macOS
   System Preferences > Software Update

2. Update All Applications

   • Use package managers (apt, brew, winget)
   • Enable automatic updates where possible
   • Remove unused/outdated software

3. Enable Firewall

   # Windows
   Enable Windows Defender Firewall
   
   # Linux
   sudo ufw enable
   
   # macOS
   System Preferences > Security & Privacy > Firewall

4. Disable Unnecessary Services

   • Review running services
   • Disable unused network services
   • Close unnecessary ports

5. Strong Password Policy

   • Change default passwords
   • Use password manager
   • Enable multi-factor authentication

CVSS Score Interpretation

CVSS (Common Vulnerability Scoring System) rates vulnerability severity:

Score Range	Severity	Action Required
9.0 - 10.0	Critical	Immediate action
7.0 - 8.9	High	Urgent attention
4.0 - 6.9	Medium	Schedule remediation
0.1 - 3.9	Low	Review when convenient

Vulnerability Prioritization Framework

Priority 1 (Critical - Fix Immediately)

• Remotely exploitable vulnerabilities
• CVSS score 9.0+
• Active exploits in the wild
• Affects internet-facing services

Priority 2 (High - Fix Within 7 Days)

• CVSS score 7.0-8.9
• Local privilege escalation
• Authentication bypass
• Data exposure risks

Priority 3 (Medium - Fix Within 30 Days)

• CVSS score 4.0-6.9
• Requires user interaction
• Limited impact
• Defense-in-depth improvements

Priority 4 (Low - Fix When Convenient)

• CVSS score < 4.0
• Informational findings
• Best practice recommendations
• Configuration improvements

False Positives

What is a False Positive?

A false positive occurs when a vulnerability scanner reports a vulnerability that doesn't actually exist or isn't exploitable in your environment.

Common False Positives

1. Version-based detection: Scanner flags software version without confirming actual vulnerability
2. Protected services: Vulnerability exists but is mitigated by other controls
3. Misconfigured scans: Incorrect target information or scan settings
4. Network filtering: Service appears vulnerable but is blocked by firewall

Handling False Positives

1. Manually verify the vulnerability
2. Test the exploit in a safe environment
3. Document why it's a false positive
4. Mark as exception in scanner
5. Retest in future scans

Scan Frequency Recommendations

Environment	Frequency	Reason
Personal PC	Monthly	Catch new vulnerabilities
Development Systems	Weekly	Frequent changes
Production Servers	Weekly-Daily	High risk exposure
Critical Infrastructure	Daily-Continuous	Maximum protection
After Major Changes	Immediately	Verify security posture

Screenshots

Include screenshots of:

1. Scanner Dashboard

   • Location: screenshots/01-scanner-dashboard.png
   • Shows: Initial interface and configuration

2. Scan Configuration

   • Location: screenshots/02-scan-config.png
   • Shows: Target settings and scan policy

3. Scan Progress

   • Location: screenshots/03-scan-progress.png
   • Shows: Running scan with progress indicator

4. Vulnerability Summary

   • Location: screenshots/04-vulnerability-summary.png
   • Shows: Overview of findings by severity

5. Detailed Vulnerability

   • Location: screenshots/05-detailed-vuln.png
   • Shows: Specific vulnerability details with CVSS

6. Remediation Recommendations

   • Location: screenshots/06-remediation.png
   • Shows: Suggested fixes

Key Learnings

Technical Skills Gained

• How to install and configure vulnerability scanners
• Understanding vulnerability reports and metrics
• CVSS scoring and risk assessment
• Remediation planning and prioritization

Security Concepts

• Difference between scanning and penetration testing
• Importance of regular security assessments
• Risk-based vulnerability management
• Security patch management

Best Practices

• Regular scanning schedules
• Documented remediation processes
• False positive handling
• Security baseline maintenance

Vulnerability Scanning vs Penetration Testing

Aspect	Vulnerability Scanning	Penetration Testing
Purpose	Identify known vulnerabilities	Exploit vulnerabilities
Approach	Automated tool-based	Manual + automated
Depth	Surface-level detection	Deep exploitation
Frequency	Weekly/Monthly	Quarterly/Yearly
Skill Level	Basic-Intermediate	Advanced
Cost	Low (free tools available)	High (expert required)
Output	Vulnerability list	Exploitation report

Ethical Considerations

Legal Requirements

• Only scan systems you own or have written permission to scan
• Unauthorized scanning is illegal (Computer Fraud and Abuse Act)
• Respect privacy and data protection laws
• Follow responsible disclosure for found vulnerabilities

Professional Ethics

• Don't exploit vulnerabilities found on others' systems
• Report critical vulnerabilities to system owners
• Maintain confidentiality of scan results
• Follow industry standards (NIST, ISO 27001)

Additional Resources

Vulnerability Databases

• NVD (National Vulnerability Database): https://nvd.nist.gov/
• CVE (Common Vulnerabilities and Exposures): https://cve.mitre.org/
• Exploit-DB: https://www.exploit-db.com/

Learning Resources

• OWASP: https://owasp.org/
• SANS Reading Room: https://www.sans.org/reading-room/
• NIST Cybersecurity Framework: https://www.nist.gov/cyberframework

Free Scanners

• OpenVAS: https://www.openvas.org/
• Nessus Essentials: https://www.tenable.com/products/nessus/nessus-essentials
• Nikto (web scanner): https://cirt.net/Nikto2

Files Included

vulnerability-scan-task/
├── README.md                          # This file
├── INTERVIEW_QUESTIONS.md             # Detailed Q&A
├── reports/
│   ├── vulnerability_scan_report.pdf  # Full scan report
│   ├── vulnerability_scan_report.html # HTML version
│   └── executive_summary.md           # High-level summary
├── screenshots/
│   ├── 01-scanner-dashboard.png
│   ├── 02-scan-config.png
│   ├── 03-scan-progress.png
│   ├── 04-vulnerability-summary.png
│   ├── 05-detailed-vuln.png
│   └── 06-remediation.png
└── scripts/
    └── report_parser.py               # Optional: Parse scan results

Conclusion

This vulnerability scanning exercise demonstrates the importance of proactive security assessment. Regular scanning helps identify and remediate security weaknesses before they can be exploited by attackers.

Key Takeaways:

• Vulnerability scanning is essential for maintaining security posture
• Regular scans help catch new vulnerabilities quickly
• CVSS scoring helps prioritize remediation efforts
• Automated scanning complements but doesn't replace manual security testing

Next Steps

1. Schedule Regular Scans: Set up monthly vulnerability scans
2. Track Remediation: Create tickets for each vulnerability
3. Verify Fixes: Rescan after applying patches
4. Learn More: Study penetration testing techniques
5. Practice: Set up intentionally vulnerable VMs (like Metasploitable)

---

Completed by: [Your Name] Date: [Completion Date] Tool Used: [OpenVAS/Nessus Essentials] Scan Duration: [X minutes]

Stay secure! 🔒