> For the complete documentation index, see [llms.txt](https://abrahamreyes9.gitbook.io/cysa+/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://abrahamreyes9.gitbook.io/cysa+/1.0-threat-and-vulnerability-management/1.4-given-a-scenario-analyse-the-output-from-common-vulnerability-assessment-tools.md).

# 1.4 Given a scenario, analyse the output from common vulnerability assessment tools

* Web application scanner:
* OWASP ZAP
* Burp suite
* Nikto
* Arachni: evaluate web application security; scanning, scripted audits, vulnerability scans
* Infrastructure vulnerability scanner:
  * Nessus
  * OpenVAS
  * Qualys
* Software assessment tools and techniques:
  * Static analysis
  * Dynamic analysis
  * Reverse engineering
  * Fuzzing
* Enumeration:
  * Nmap: returns port listing, MAC address, OS/kernel version, network distance, runtime
  * hping: sends TCP/UDP/ICMP/RAW-IP; firewall testing, TCP/IP auditing, network testing
  * Active vs passive
  * Responder: LLMNR/NBT-NS poisoner/rogue authentication server => steal NTLM hashes
* Wireless assessment tools:
  * Aircrack-ng: suite of WiFi monitoring, attacking, testing & cracking (WEP/WPA) tools
  * Reaver: brute force against WPS PINs to recover WPA/WPA2 passphrases
  * oclHashcat: GPU-based hash cracker with dictionaries, masks, rules etc.
* Cloud infrastructure assessment tools:
  * ScoutSuite: security posture assessment of cloud environments, highlights risks
  * Prowler: AWS security best practices assessment, auditing, hardening, forensics