In this section of the course,
we're going to discuss the topic of analyzing scans.
The process of analyzing scans
is about sifting through the data that we've collected
to separate the signal from the noise,
which means we want to distinguish
between what's a real security vulnerability
and what might just be a false alarm.
By understanding these results,
we can zero in on genuine vulnerabilities
and plan our attacks accordingly.
Our focus in this section will be centered around Domain 3,
Vulnerability Discovery and Analysis,
and also Domain 4, Attacks and Exploits.
In this section, we will focus on Objectives 3.2 and 4.1.
Objective 3.2 tells us, given the scenario,
we need to analyze the output from reconnaissance, scanning,
and enumeration phases.
Objective 4.1 states that given a scenario,
we should be able to analyze output to prioritize
and prepare for attacks.
The first topic in this section
will be covering how to interpret both Positive
and Negative Results from our scans.
Understanding what a negative result is can tell us
just as much as understanding a positive one.
Sometimes no news is news as well.
We'll then discuss the importance
of Validating Scan Results.
It's one thing to get results from a scan,
it's another thing to make sure they're accurate.
We'll look at the techniques to confirm our findings.
Using CVEs and CVSS will be up next.
These are systems that help us understand the severity
of the vulnerabilities we find,
so we know which ones to tackle first.
Then we'll discuss The Exploit Prediction Scoring System,
or EPSS,
which allows us to predict the likelihood a vulnerability
will be exploited.
This helps us prioritize which issues to address first.
Moving on, we'll discuss Target Prioritization,
which is critical in deciding where to focus our effort.
Not all vulnerabilities are created equal,
so we need to know which ones pose the greatest risk,
which will give us the best odds for exploitation.
We'll then cover Common Target Criteria,
discussing what makes a particular system
or application a more likely target than others.
Next, we will walk you through a demo
on scripting for Result Validation,
which will show you how to,
how to make the process of checking our scan results,
ensuring they're as accurate as possible.
Then we will cover Scan Validation,
which are essential for confirming
that the scan itself is working properly
and how to troubleshoot
common scanning configuration issues.
This makes sure we don't waste time chasing a target
or a vulnerability that might not even exist.
After that, we'll talk about Capability selection,
where we'll be deciding which tools
and method to use based on our scan results.
Next, we'll discuss the process of Documenting the Attack,
which is all about keeping a clear record
of what we're planning.
This not only helps us stay organized,
but also maintains a clear chain
of events used in our final report.
And lastly, the final topic we'll look at focuses
on Other Attack Considerations,
which might include everything from the nuances
and network layouts
to potential business impact of an exploit.
Finally, we'll take a short quiz
to see what you learned during this section of the course
and review each of those quiz questions fully
to ensure that you can explain why each answer was right.
So if you're ready, let's jump right into analyzing scans.