20. Vulnerability Scanning and Assessment
20.6 Reading Results: False Positives and Prioritising
Scanner ne 200 findings dile mhanje 200 problems nahit. Ethical hacker cha khara kaam mhanje kharya dhokyanchi nivad karne.
| Term | Meaning | Example |
|---|---|---|
| True positive | Scanner says vulnerable, and it really is | vsftpd 2.3.4 backdoor confirmed |
| False positive | Scanner says vulnerable, but it is not | Version guessed wrongly from a banner; the package was patched |
| False negative | Real vulnerability the scanner missed | A logic flaw in your own PHP code |
| True negative | Not vulnerable, and scanner agrees | – |
How to confirm a finding: check the exact installed version on the server (rpm -q httpd on Amazon Linux, dpkg -l | grep apache2 on Ubuntu), read the vendor advisory, reproduce the check safely in the lab, and look for evidence (a response, a file, a banner) you can screenshot.
How to prioritise – not just by CVSS score:
- Critical/High and reachable from the internet – fix first (for example an open database port with a known remote bug).
- Known to be exploited in the wild – CISA publishes a "Known Exploited Vulnerabilities" catalog; anything listed there jumps the queue.
- Easy to exploit – a public exploit exists and no login is needed.
- Business impact – the server holding customer data matters more than a test box.
- Medium/Low – fix in the normal patch cycle.
Ravindra Bagale's Tip
Report madhe scanner cha output copy-paste karna hi sarvat mothi chuk. Client la 300 pages nako, tyala hava "aadhi he 5 fix kara". False positives kadha, confirm kara, aani priority dya – yalach assessment mhantat, nusta scan nahi.
Practice task
From your Greenbone report, choose five High or Critical findings. For each, write whether it is a true or false positive and how you confirmed it, then rank them 1–5 using the list above with one line explaining each rank.