20. Vulnerability Scanning and Assessment
20.6 Reading Results: False Positives and Prioritising
Scanner ne 200 findings dile mhanje 200 problems nahit. Ethical hacker cha khara kaam mhanje kharya dhokyanchi nivad karne.
| Term | Meaning | Example |
|---|---|---|
| True positive | Scanner says vulnerable, and it really is | vsftpd 2.3.4 backdoor confirmed |
| False positive | Scanner says vulnerable, but it is not | Version guessed wrongly from a banner; the package was patched |
| False negative | Real vulnerability the scanner missed | A logic flaw in your own PHP code |
| True negative | Not vulnerable, and scanner agrees | – |
How to confirm a finding: check the exact installed version on the server (rpm -q httpd on Amazon Linux, dpkg -l | grep apache2 on Ubuntu), read the vendor advisory, reproduce the check safely in the lab, and look for evidence (a response, a file, a banner) you can screenshot.
How to prioritise – not just by CVSS score:
- Critical/High and reachable from the internet – fix first (for example an open database port with a known remote bug).
- Known to be exploited in the wild – CISA publishes a "Known Exploited Vulnerabilities" catalog; anything listed there jumps the queue.
- Easy to exploit – a public exploit exists and no login is needed.
- Business impact – the server holding customer data matters more than a test box.
- Medium/Low – fix in the normal patch cycle.
Ravindra Bagale's Tip
Copy-pasting the scanner output into the report is the biggest mistake. The client doesn't want 300 pages; they want "fix these 5 first". Remove false positives, confirm findings and set priorities – that is what we call an assessment, not just a scan.
Ravindra Bagale's Tip – मराठी
Report मध्ये scanner चा output copy-paste करणं ही सर्वात मोठी चूक. Client ला 300 pages नको, त्याला हवं "आधी हे 5 fix करा". False positives काढा, confirm करा आणि priority द्या – यालाच assessment म्हणतात, नुसता scan नाही.
Ravindra Bagale's Tip – हिंदी
Report में scanner का output copy-paste करना सबसे बड़ी गलती है. Client को 300 pages नहीं चाहिए, उसे चाहिए "पहले ये 5 fix करो". False positives हटाओ, confirm करो और priority दो – इसी को assessment कहते हैं, सिर्फ़ scan नहीं.
Practice task
From your Greenbone report, choose five High or Critical findings. For each, write whether it is a true or false positive and how you confirmed it, then rank them 1–5 using the list above with one line explaining each rank.