Web vulnerability scanning in Cybersecurity - Mini Project: Build & Apply

Web Vulnerability Scanning Basics

📖 Scenario: You are a cybersecurity analyst tasked with checking a website for common security weaknesses. You will create a simple checklist and process to scan for vulnerabilities.

🎯 Goal: Build a step-by-step checklist and scanning plan for web vulnerability scanning to identify common security issues.

📋 What You'll Learn

Create a list of common web vulnerabilities

Add a threshold for risk level

Write a loop to filter vulnerabilities above the threshold

Add a final step to mark the scan as complete

💡 Why This Matters

🌍 Real World

Web vulnerability scanning helps identify security weaknesses in websites before attackers can exploit them.

💼 Career

Cybersecurity professionals use scanning tools and processes like this to protect organizations from data breaches and attacks.

1

Create a list of common web vulnerabilities

Create a list called vulnerabilities with these exact entries: 'SQL Injection', 'Cross-Site Scripting', 'Broken Authentication', 'Sensitive Data Exposure', and 'Security Misconfiguration'.

Cybersecurity

# Create the list vulnerabilities with the specified entries
# Your code here

Hint

Use square brackets to create a list and include all five vulnerability names as strings.

2

Add a risk threshold for scanning

Create a variable called risk_threshold and set it to the integer 3 to represent the minimum risk level to scan for.

Cybersecurity

vulnerabilities = ['SQL Injection', 'Cross-Site Scripting', 'Broken Authentication', 'Sensitive Data Exposure', 'Security Misconfiguration']
# Create risk_threshold variable and set it to 3
# Your code here

Hint

Use a simple assignment to create the risk_threshold variable with value 3.

3

Filter vulnerabilities by risk level

Create a dictionary called risk_levels with these exact key-value pairs: 'SQL Injection': 5, 'Cross-Site Scripting': 4, 'Broken Authentication': 3, 'Sensitive Data Exposure': 2, and 'Security Misconfiguration': 1. Then create a list called high_risk_vulnerabilities that includes only vulnerabilities from vulnerabilities whose risk level in risk_levels is greater than or equal to risk_threshold. Use a list comprehension with variables vuln and risk_levels[vuln].

Cybersecurity

vulnerabilities = ['SQL Injection', 'Cross-Site Scripting', 'Broken Authentication', 'Sensitive Data Exposure', 'Security Misconfiguration']
risk_threshold = 3
# Create risk_levels dictionary and high_risk_vulnerabilities list using list comprehension
# Your code here

Hint

Use curly braces to create the dictionary and a list comprehension to filter vulnerabilities by risk.

4

Mark the scan as complete

Create a boolean variable called scan_complete and set it to True to indicate the vulnerability scan is finished.

Cybersecurity

vulnerabilities = ['SQL Injection', 'Cross-Site Scripting', 'Broken Authentication', 'Sensitive Data Exposure', 'Security Misconfiguration']
risk_threshold = 3
risk_levels = {'SQL Injection': 5, 'Cross-Site Scripting': 4, 'Broken Authentication': 3, 'Sensitive Data Exposure': 2, 'Security Misconfiguration': 1}
high_risk_vulnerabilities = [vuln for vuln in vulnerabilities if risk_levels[vuln] >= risk_threshold]
# Create scan_complete variable and set it to True
# Your code here

Hint

Use a simple assignment to create the scan_complete variable with value True.

Practice

1. What is the main purpose of web vulnerability scanning?

easy

A. To increase website traffic

B. To improve website design

C. To find security weaknesses in websites

D. To create new web pages

Solution

1. Step 1: Understand the goal of vulnerability scanning

   Web vulnerability scanning is used to detect security issues that could be exploited by attackers.

2. Step 2: Compare options to the goal

   Only To find security weaknesses in websites matches the goal of finding security weaknesses.

3. Final Answer:

   To find security weaknesses in websites -> Option C

4. Quick Check:

   Purpose of scanning = Find weaknesses [OK]

Hint: Focus on security goals, not design or traffic [OK]

Common Mistakes:

• Confusing scanning with website design
• Thinking scanning increases traffic
• Assuming scanning creates content

2. Which of the following is a correct step in performing a web vulnerability scan?

easy

A. Scanning regularly and after changes

B. Scanning only after major website changes

C. Ignoring scan results

D. Disabling security tools during scan

Solution

1. Step 1: Identify best practices for scanning

   Regular scanning and scanning after changes help catch new vulnerabilities early.

2. Step 2: Evaluate options

   Only Scanning regularly and after changes correctly describes this practice.

3. Final Answer:

   Scanning regularly and after changes -> Option A

4. Quick Check:

   Best practice = Regular scans [OK]

Hint: Scan often and after updates to catch issues [OK]

Common Mistakes:

• Skipping scans after updates
• Ignoring scan results
• Disabling security tools

3. A web vulnerability scanner reports the following issues: SQL Injection, Cross-Site Scripting (XSS), and outdated software versions. What should be the next step?

medium

A. Ignore the report and continue using the website

B. Delete the website to prevent attacks

C. Disable the scanner to avoid false alarms

D. Fix the reported vulnerabilities to secure the website

Solution

1. Step 1: Understand the meaning of reported issues

   SQL Injection and XSS are serious vulnerabilities that attackers can exploit. Outdated software can have known security flaws.

2. Step 2: Determine the correct action

   The correct response is to fix these vulnerabilities to protect the website and users.

3. Final Answer:

   Fix the reported vulnerabilities to secure the website -> Option D

4. Quick Check:

   Fix vulnerabilities = Secure website [OK]

Hint: Always fix vulnerabilities found by scans [OK]

Common Mistakes:

• Ignoring reports
• Deleting website unnecessarily
• Disabling scanners

4. You ran a web vulnerability scan but the report shows no vulnerabilities, yet you suspect there are issues. What could be a reason for this?

medium

A. The scanner was not configured properly

B. The website is perfectly secure

C. The scan was done too frequently

D. The scanner always misses vulnerabilities

Solution

1. Step 1: Analyze why a scan might miss vulnerabilities

   If the scanner is not set up correctly, it may not test all areas or types of vulnerabilities.

2. Step 2: Evaluate other options

   The website is perfectly secure is unlikely if issues are suspected. The scan was done too frequently is unrelated. The scanner always misses vulnerabilities is incorrect because scanners do not always miss vulnerabilities.

3. Final Answer:

   The scanner was not configured properly -> Option A

4. Quick Check:

   Misconfiguration = Missed vulnerabilities [OK]

Hint: Check scanner settings if no issues found but suspected [OK]

Common Mistakes:

• Assuming website is perfect
• Blaming scan frequency
• Thinking scanners always fail

5. A company wants to automate web vulnerability scanning for multiple websites daily. Which approach best balances thoroughness and resource use?

hard

A. Run full scans on all websites every day

B. Run quick scans daily and full scans weekly

C. Run scans only when a website is updated

D. Run scans manually when issues are reported

Solution

1. Step 1: Understand scanning trade-offs

   Full scans are thorough but resource-heavy; quick scans are lighter but less detailed.

2. Step 2: Evaluate options for balance

   Run quick scans daily and full scans weekly uses quick scans daily to catch urgent issues and full scans weekly for depth, balancing resources and security.

3. Final Answer:

   Run quick scans daily and full scans weekly -> Option B

4. Quick Check:

   Balance thoroughness and resources = Run quick scans daily and full scans weekly [OK]

Hint: Use quick daily and full weekly scans for efficiency [OK]

Common Mistakes:

• Running full scans daily wastes resources
• Scanning only after updates misses risks
• Manual scans delay detection