Scanners & Recon

A Nessus plugin is a NASL program from Tenable, usually testing for one issue. Its numeric ID names the finding, its family groups it for selection in a policy, and its type says how it gathered evidence.

A QID (Qualys ID) is the number of one detection in the Qualys KnowledgeBase. A CVE names a published flaw; a QID is Qualys's test and verdict, may list several CVEs, and can carry none at all.

An unauthenticated scan infers from what services expose on the network: banners, version strings, protocol behaviour. A credentialed scan logs in and reads installed package versions and configuration, so it decides from the host's own record instead of a guess.

A point-in-time scan proves the state of the hosts it reached on the day it ran. It misses hosts that came and went between runs, changes made since, and newly disclosed flaws in software it already saw.

Both Greenbone feeds publish daily. The free Community Feed carries the most important VTs plus basic configs, without VTs for enterprise products and with no warranty; the commercial Enterprise Feed adds those VTs, compliance checks, more report formats and an SLA.

zap-baseline.py exits 1 if a rule marked FAIL alerted, 2 if only WARN-bucket rules did, 0 if at least one rule ran and raised nothing, and 3 for everything else. -I removes only the exit-2 branch.

A definition lists every operation whether or not anything links to it, and the openapi add-on sends a real request for each one. A link-following crawl can only enqueue what a response already points at.

Risk is how damaging the finding would be if it is real. Confidence is how sure the scan rule is that it is real. They are two separate fields on the alert, set independently.

ZAP performs no ownership or authorisation check on a target — nothing in it resolves who owns a host. It ships only a permission warning on rendered screens such as its welcome text and Quick Start panel.

Core is one versioned program: the command line, the control API, the active-scan engine, and the alert and context models. Almost everything else — the local proxy, the passive-scan engine, the crawlers, automation, reports — ships as separately versioned add-ons.

A capture filter, written in libpcap's filter language, decides which packets are ever recorded; anything it rejects is gone for good. A display filter, written in Wireshark's field syntax, only hides packets already captured and can be changed freely.

Capture on the interface the flow really crosses; the welcome screen's activity sparklines and dumpcap -D show which interfaces are live. Traffic to 127.0.0.1 is delivered inside the operating system and never reaches the Ethernet adapter, so capture it on the loopback interface.

A Wireshark display filter compares typed fields the dissectors registered: http.response.code >= 500 is a numeric test. A bare field name only tests that the field exists, so tcp.flags.syn alone matches nearly every TCP packet.

Expert Information lists anomalies that dissectors flagged, ranked Chat, Note, Warn, Error from lowest to highest (packet comments sit below Chat) and grouped by kind, such as Sequence or Malformed. It shows where to look; it never diagnoses.

Follow TCP Stream rebuilds one connection's payload as the applications exchanged it, both directions in sequence order with retransmitted bytes shown once, and applies the display filter tcp.stream eq N, which Back removes and Close keeps.

List capture devices with tcpdump -D, capture with tcpdump -i eth0 -w /var/tmp/web.pcap and a filter, stop with -c or Ctrl-C, then read the file with -r or Wireshark. Use -i any only to find the interface.

Use tcp port 5432 and host 192.0.2.10. Each primitive is an id with qualifiers: proto (tcp, ip, ip6), dir (src, dst) and type (host, net, port, portrange). Missing ones default to host, src or dst, and every consistent protocol.

Each character is one TCP control bit that is set: S SYN, F FIN, P PSH, R RST, U URG, and a dot for ACK. So [S.] is SYN plus ACK, [P.] data with ACK, and [.] a bare acknowledgment.

tcp[tcpflags] & (tcp-syn|tcp-ack) == tcp-syn keeps the SYN and ACK bits and requires SYN alone. Testing only the SYN bit also matches every SYN-ACK, because the reply carries SYN too. The numeric form is tcp[13] & 0x12 == 2.

Three [S] lines with the same source port and seq are one SYN retransmitted because nothing reached this capture point in reply. A refused attempt is one [S] answered within a round trip by [R.] acking the SYN's seq plus one.

No. Trivy 0.74 exits 0 whatever it finds; setting --exit-code to a non-zero value makes it exit with that code when any finding survives filtering, and --severity HIGH,CRITICAL decides which findings survive.

Run trivy config on the folder; it detects each file's type and applies the built-in trivy-checks bundle. Each failure gives severity, check ID, title, an AVD link and file lines. fs, image and repo skip this unless --scanners misconfig is set.

Run trivy image with --format cyclonedx, spdx or spdx-json and --output to save the package inventory with the release. Later, trivy sbom on that file matches the recorded packages against Trivy's current vulnerability database, with no image pull.

Each Trivy subcommand enables a different set of analyzers: fs and repo read pre-build lockfiles, while image, rootfs and vm read post-build evidence such as OS package databases, installed package metadata, Go binaries and JARs, and skip most lockfiles.

--severity keeps only findings whose assigned severity is listed, all five levels by default; --ignore-unfixed drops findings whose status is not fixed. Both filter the finished report, so neither changes what was detected or how it was rated.

Checkov exits 0 when every check passed or was skipped and 1 when any check failed. With -s or --soft-fail it always exits 0 but still reports every failure, which is different from skipping a check, which never runs.

A CKV_ check reads one resource's own settings; a CKV2_ graph check tests how resources are connected, such as a bucket and its public access block. A clean bucket still fails when that linked resource is missing or unreferenced.

--create-baseline writes the current failures to a .checkov.baseline file; later runs with --baseline report only failures not in it. Matching uses resource address plus check ID, ignoring the file, so renames resurface old debt and same-named resources slip through.

Checkov renders variables only from defaults, TF_VAR_ variables and Terraform's automatic tfvars files, so it judged the default. Pass --var-file prod.tfvars, or scan the plan JSON with the terraform_plan framework.

Checkov drops the helm framework when no helm 3 binary is installed, skips registry and git modules unless --download-external-modules true is set, ignores .terraform, and runs only the listed checks when --check is used.

KICS detects which supported IaC types the path contains, runs the matching built-in Rego queries, prints the findings, and writes results.json into ./kics-out; other formats need --report-formats, and without -o no file is written.

Status 40 means the worst counted finding was MEDIUM, with no counted CRITICAL (60) or HIGH (50). --fail-on lists which severities may set the status, and --ignore-on-exit can mute result codes, engine-error codes, or both.

Each built-in query is a folder holding query.rego and a metadata.json whose id is a UUID; that UUID is what --include-queries and --exclude-queries take, alongside --exclude-categories, --exclude-severities, --type and --queries-path.

Walk the pipeline: was the file collected (.gitignore, --exclude-paths, kics.config, the 5 MB cap, --type), parsed, evaluated (query filters, timeouts), resolved (tfvars, functions, custom modules), suppressed (kics-scan comments, -x), or merely not counted by --fail-on?

kics-scan comments suppress results from inside the scanned file. ignore, enable= and disable= are file-level and work only above the first real line; ignore-line and ignore-block work anywhere, so an ignore inside a resource is disregarded.