OSCP · Module 4
Vulnerability Scanning
Automated vulnerability scanning with Nmap NSE scripts, Nuclei, and Nikto to identify known CVEs, misconfigurations, and missing patches across networks and web applications.
~1.5 h 4 resources Last updated September 25, 2026
Vulnerability scanning uses automated tools to identify known weaknesses across networks, services, and web applications. PEN-200 focuses on Nessus and Nmap NSE scripts as primary scanners. The goal is not to replace manual enumeration but to quickly surface known CVEs, misconfigurations, and missing patches that would take too long to find by hand.
Network Vulnerability Scanning
Nmap's NSE vuln category and dedicated tools like Nessus scan entire hosts or ranges for known vulnerabilities. Results need manual verification: false positives are common, and scanners miss anything that requires authentication or chained exploitation.
Web Application Scanning
Web scanners like Nuclei and Nikto check for misconfigurations, default credentials, exposed debug endpoints, and known CVEs in web frameworks. They complement manual testing but do not replace it for logic flaws, authorization issues, or chained vulnerabilities.
Read
The core material for this module. Where a guide goes deeper than needed, the relevant sections are highlighted.