Vulnerability Assessment Scanning

---
name: vulnerability-assessment-scanning
description: "Use when performing vulnerability scanning and assessment."
version: 1.0.0
author: Hermes Agent
license: MIT
metadata:
  hermes:
    tags: [vulnerability-assessment, scanning, Nessus, OpenVAS, Nuclei, CVE, CVSS]
    related_skills: [penetration-testing-methodology, network-scanning-enumeration, webapp-penetration-testing, bug-bounty-methodology]
---

# Vulnerability Assessment and Scanning

Performing vulnerability assessments — from automated scanning (Nessus, OpenVAS, Nuclei) through manual verification, risk prioritization, and reporting.

## When to Use

- Scanning networks for known vulnerabilities
- Prioritizing vulnerabilities by risk and exploitability
- Automating vulnerability scanning in CI/CD
- Manual verification of scan findings
- Building vulnerability management programs

## Scanning Tools

```python
SCANNING_TOOLS = {
    'nessus': 'Comprehensive, credentialed scanning, CVSS scoring, compliance checks',
    'openvas': 'Open-source, Greenbone Security Assistant, extensive plugin library',
    'nuclei': 'YAML-based template scanner — fast, community templates, CI/CD integration',
    'nexpose': 'Rapid7 — risk-based scoring, real-time integration with Metasploit',
    'qualys': 'Cloud-based, asset management, PCI scanning, continuous monitoring',
}

class VulnerabilityAssessment:
    """Manage vulnerability assessment program."""
    def __init__(self):
        self.scan_results = []
        self.remediated = []
        self.accepted_risks = []
    
    def prioritize(self, results: List[Dict]) -> List[Dict]:
        """Prioritize by CVSS score, exploit availability, asset criticality."""
        for r in results:
            r['priority'] = sum([
                r.get('cvss', 0) * 10,              # CVSS weight
                r.get('exploit_available', 0) * 30,  # Exploit weight
                r.get('asset_criticality', 0) * 20,  # Criticality weight
            ])
        return sorted(results, key=lambda r: r['priority'], reverse=True)
```

## Verification Checklist

- [ ] Scanning scope defined (IP ranges, ports, protocols)
- [ ] Credentialed scans for authenticated assessment
- [ ] Scan tool configured (Nessus, OpenVAS, Nuclei, or combination)
- [ ] False positives identified and removed
- [ ] Vulnerabilities verified manually (not just scanner output)
- [ ] Risk-ranked (CVSS + exploitability + asset criticality)
- [ ] Remediation recommendations provided
- [ ] Re-scan after remediation to verify fixes
- [ ] Executive summary with risk trends over time