Network vulnerability scanning explained
Vulnerability scanning is an automated inspection of computers, networks and applications to identify security weaknesses that an attacker could exploit.
What a network vulnerability scan does
A network vulnerability scanner checks systems and network devices against a database of known weaknesses: open ports, outdated or unpatched services, weak configurations and default credentials. It then classifies what it finds by severity so the most serious issues can be fixed first.
Scans may be run by an organisation's own IT or security team, or by an external provider. Some standards require them: under PCI DSS, for example, external scans of systems that handle payment card data must be performed by an Approved Scanning Vendor (ASV). Attackers also run scans, looking for points of entry.
Authenticated and unauthenticated scans
- Unauthenticated scan: the scanner has no credentials, so it sees what an outside attacker would see.
- Authenticated scan: the scanner logs in, so it also finds weaknesses that are visible to a trusted user, or to an attacker who has obtained a user's access.
Running both gives the most complete picture.
Things to keep in mind
- Scanning can be intrusive. Some checks can cause errors or restarts on fragile systems, so schedule scans carefully and tell system owners in advance.
- A scan is a point-in-time result. Scan regularly, and after significant changes.
- Network scanning does not test the logic of your web applications. Flaws such as SQL injection or broken access control need a web application scanner.
How Vooki Pro helps
- Vooki Pro is a web application and API scanner: it tests the application layer that network scanners do not reach.
- Also checks TLS configuration, certificates and outdated server software on your web hosts.
- Use it alongside your network scanner for full coverage.
Frequently asked questions
Is a network scan enough for a website?
No. Network scanners find open ports and outdated services, but not flaws in your application's own logic, such as SQL injection or IDOR.
Do I need both?
Yes. Network scanning covers infrastructure; DAST covers the web application and APIs.
Try Vooki Pro free for 7 days
Add application-layer testing to your network scans. The trial unlocks every feature for 7 days, and scanning runs on your own machine.
Related: What is DAST (dynamic application security testing)? · HTTPS done right: HSTS and TLS configuration
Related Articles
Top mistakes in web vulnerability assessments
Thousands of new vulnerabilities are reported in software every year, and many stay open for weeks or even years while organisations struggle to manage them. These are some of the most common mistakes made during web vulnerability assessments, and ...Scanning applications behind a WAF or rate limits
Web application firewalls (WAFs) and rate limits protect production, but they also block security scanners. A scan that was silently blocked looks exactly like a clean scan, which is dangerous. How it works The WAF recognises attack payloads and ...Web application vulnerability assessment checklist
A vulnerability assessment identifies the security weaknesses in a web application and rates each one by severity. This checklist covers the whole process in 14 sections and 118 checks, from planning to retesting. It follows the way the OWASP Web ...DOM-based XSS (DOM XSS) explained
DOM-based cross-site scripting (DOM XSS) is a type of XSS where the vulnerability is in the page's own client-side JavaScript. The script reads data from a source the attacker can control, such as the URL, and writes it into the page in an unsafe ...Why web vulnerability testing should be automated
Whether you run a website or simply use one, you want to know that it is secure. Browsers help a little: they warn you when a site's connection is not secure. But a browser warning only covers the connection. It says nothing about weaknesses inside ...