Lab 04: Vulnerability Assessment & CVSS Scoring¶

docker network create vulnlab
docker run -d \
  --name vuln-target \
  --network vulnlab \
  vulnerables/web-dvwa
sleep 5
docker inspect vuln-target | grep '"IPAddress"' | tail -1

docker run --rm --network vulnlab ubuntu:22.04 bash -c "
apt-get update -qq && apt-get install -y -qq nikto 2>/dev/null
nikto -host http://vuln-target -maxtime 60 2>&1 | grep -v '^$' | head -40"

docker run --rm --network vulnlab ubuntu:22.04 bash -c "
apt-get update -qq && apt-get install -y -qq nikto 2>/dev/null
nikto -host http://vuln-target -Tuning 9 2>&1 | grep -E 'OSVDB|CVE|\+' | head -20"

docker run --rm --network vulnlab instrumentisto/nmap \
  nmap --script=http-shellshock,http-phpself-xss,http-internal-ip-disclosure \
  10.10.0.0/24 -p 80

docker run --rm --network vulnlab instrumentisto/nmap \
  nmap --script="http-vuln*" -p 80 vuln-target 2>/dev/null | head -30

docker run --rm python:3.11-slim python3 -c "
# CVSS v3.1 Base Score calculation
def cvss_severity(score):
    if score == 0: return 'None'
    elif score < 4.0: return 'Low'
    elif score < 7.0: return 'Medium'
    elif score < 9.0: return 'High'
    else: return 'Critical'

vulnerabilities = [
    {
        'name': 'SQL Injection (DVWA Login)',
        'cve': 'CWE-89',
        'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H',
        'score': 9.8,
        'description': 'Network-exploitable SQLi, no privileges needed, all 3 CIA pillars',
    },
    {
        'name': 'Outdated Apache 2.4.25',
        'cve': 'CVE-2017-7679',
        'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H',
        'score': 9.8,
        'description': 'Remote buffer overflow in mod_mime - no auth required',
    },
    {
        'name': 'Missing X-Frame-Options Header',
        'cve': 'CWE-693',
        'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N',
        'score': 6.1,
        'description': 'Clickjacking possible - requires user interaction',
    },
    {
        'name': 'Default Credentials (admin/password)',
        'cve': 'CWE-521',
        'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H',
        'score': 9.8,
        'description': 'Network-accessible with default credentials = full compromise',
    },
]

vulnerabilities.sort(key=lambda x: -x['score'])
print('=== VULNERABILITY ASSESSMENT REPORT ===')
print(f'{\"Risk\":<10} {\"Score\":<7} {\"Finding\":<35} {\"CVE/CWE\"}')
print('-' * 75)
for v in vulnerabilities:
    sev = cvss_severity(v['score'])
    print(f'{sev:<10} {v[\"score\"]:<7} {v[\"name\"]:<35} {v[\"cve\"]}')
    print(f'{\"\":<17} {v[\"description\"]}')
    print()
print(f'Total findings: {len(vulnerabilities)}')
print(f'Critical: {sum(1 for v in vulnerabilities if v[\"score\"] >= 9.0)}')
print(f'High:     {sum(1 for v in vulnerabilities if 7.0 <= v[\"score\"] < 9.0)}')
print(f'Medium:   {sum(1 for v in vulnerabilities if 4.0 <= v[\"score\"] < 7.0)}')
"

docker run --rm python:3.11-slim python3 -c "
vector = 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
components = {
    'AV': {'N': 'Network (remotely exploitable)',  'A': 'Adjacent', 'L': 'Local', 'P': 'Physical'},
    'AC': {'L': 'Low (easy to exploit)',           'H': 'High (hard to exploit)'},
    'PR': {'N': 'None (no account needed)',        'L': 'Low privileges', 'H': 'High privileges'},
    'UI': {'N': 'None (no user action needed)',    'R': 'Required (user must click)'},
    'S':  {'U': 'Unchanged (limited to component)', 'C': 'Changed (affects other systems)'},
    'C':  {'N': 'None', 'L': 'Low impact', 'H': 'High impact on Confidentiality'},
    'I':  {'N': 'None', 'L': 'Low impact', 'H': 'High impact on Integrity'},
    'A':  {'N': 'None', 'L': 'Low impact', 'H': 'High impact on Availability'},
}
metrics = dict(x.split(':') for x in vector.split('/')[1:])
print('=== CVSS v3.1 VECTOR BREAKDOWN ===')
print(f'Vector: {vector}')
print()
for metric, value in metrics.items():
    desc = components.get(metric, {}).get(value, 'Unknown')
    print(f'  {metric}:{value} = {desc}')
print()
print('Score: 9.8 (Critical) - Network, Low Complexity, No Auth, Full CIA impact')
"

docker run --rm python:3.11-slim python3 -c "
comparison = {
    'Vulnerability Scanning': {
        'What it does':  'Automated tool identifies potential vulnerabilities',
        'Verification':  'Does NOT prove exploitability - many false positives',
        'Impact':        'Non-invasive - reads banners and checks configurations',
        'Output':        'List of potential issues with CVSS scores',
        'Tools':         'Nessus, OpenVAS, Nikto, nmap --script',
        'Analogy':       'Checking if doors look locked without testing the handle',
    },
    'Penetration Testing': {
        'What it does':  'Human tester actively attempts to exploit vulnerabilities',
        'Verification':  'Proves real exploitability with working proof-of-concept',
        'Impact':        'Invasive - may crash services, trigger alerts',
        'Output':        'Exploited vulnerabilities with business impact analysis',
        'Tools':         'Metasploit, Burp Suite, custom exploits',
        'Analogy':       'Picking the lock and walking inside to prove access',
    },
}
for test_type, details in comparison.items():
    print(f'=== {test_type.upper()} ===')
    for k, v in details.items():
        print(f'  {k:<15}: {v}')
    print()
"

docker stop vuln-target && docker rm vuln-target
docker network rm vulnlab
docker system prune -f