Ravindra BagaleCourses & study guides

20. Vulnerability Scanning and Assessment

20.6 Reading Results: False Positives and Prioritising

Scanner ne 200 findings dile mhanje 200 problems nahit. Ethical hacker cha khara kaam mhanje kharya dhokyanchi nivad karne.

Term Meaning Example
True positive Scanner says vulnerable, and it really is vsftpd 2.3.4 backdoor confirmed
False positive Scanner says vulnerable, but it is not Version guessed wrongly from a banner; the package was patched
False negative Real vulnerability the scanner missed A logic flaw in your own PHP code
True negative Not vulnerable, and scanner agrees –

How to confirm a finding: check the exact installed version on the server (rpm -q httpd on Amazon Linux, dpkg -l | grep apache2 on Ubuntu), read the vendor advisory, reproduce the check safely in the lab, and look for evidence (a response, a file, a banner) you can screenshot.

How to prioritise – not just by CVSS score:

  1. Critical/High and reachable from the internet – fix first (for example an open database port with a known remote bug).
  2. Known to be exploited in the wild – CISA publishes a "Known Exploited Vulnerabilities" catalog; anything listed there jumps the queue.
  3. Easy to exploit – a public exploit exists and no login is needed.
  4. Business impact – the server holding customer data matters more than a test box.
  5. Medium/Low – fix in the normal patch cycle.

Ravindra Bagale's Tip

Copy-pasting the scanner output into the report is the biggest mistake. The client doesn't want 300 pages; they want "fix these 5 first". Remove false positives, confirm findings and set priorities – that is what we call an assessment, not just a scan.

Practice task

From your Greenbone report, choose five High or Critical findings. For each, write whether it is a true or false positive and how you confirmed it, then rank them 1–5 using the list above with one line explaining each rank.