Vulnerability mapping is the process of identifying and analyzing the critical security flaws in a target environment. This is sometimes also referred to as a vulnerability assessment. It is one of the key areas of a vulnerability management program, through which the security controls of an IT infrastructure can be analyzed against known vulnerabilities. Once the operations of information gathering, discovery, and enumeration are complete, it is time to investigate the vulnerabilities in the target infrastructure that could lead to compromising the target and violating the confidentiality, integrity, and availability of a business system.

In this chapter, we will discuss two common types of vulnerabilities, present various standards for the classification of vulnerabilities, and explain some of the well-known vulnerability assessment tools provided under the Kali Linux operating system. This chapter explores the following topics:

• The concepts of two generic types of vulnerabilities: local and remote.
• The vulnerability taxonomy that points to the industry standard, which can be used to classify any vulnerability according to its unifying commonality pattern.
• A number of security tools that can assist us in finding and analyzing the security vulnerabilities present in a target environment. The tools presented are categorized according to their basic function in a security assessment process. These include Nessus, Cisco, fuzzing tools, SMB, SNMP, and web application analysis tools.

Note that the manual and automated vulnerability assessment procedures should be treated equally when handling any type of penetration testing assignment, whether internal or external. Relying strictly on automation may sometimes produce false positives and false negatives. The degree of the auditor's knowledge of technology-relevant assessment tools may be a determining factor when performing penetration tests. Both the tools used and the skill of the tester should be continually updated to ensure success. Moreover, it is necessary to mention that automated vulnerability assessment is not the final solution; there are situations where automated tools fail to identify logic errors, undiscovered vulnerabilities, unpublished software vulnerabilities, and the human variable that impacts security.

Therefore, it is recommended that an integrated approach be used that leverages both automated and manual vulnerability assessment methods. This will heighten the probability of successful penetration tests, and provide the best possible information to correct vulnerabilities.