To see any vulnerabilities that may be visible from outside of the organization, the penetration tester should perform an unauthenticated scan.
* Unauthenticated Scan:
* Definition: An unauthenticated scan is conducted without providing any credentials to the scanning tool. It simulates the perspective of an external attacker who does not have any prior access to the system.
* Purpose: Identifies vulnerabilities that are exposed to the public and can be exploited without authentication. This includes open ports, outdated software, and misconfigurations visible to the outside world.
* Comparison with Other Scans:
* SAST (Static Application Security Testing): Analyzes source code for vulnerabilities, typically used during the development phase and not suitable for external vulnerability scanning.
* Sidecar: This term is generally associated with microservices architecture and is not relevant to the context of vulnerability scanning.
* Host-based: Involves scanning from within the network and often requires authenticated access to the host to identify vulnerabilities. It is not suitable for determining external vulnerabilities.
* Pentest References:
* External Vulnerability Assessment: Conducting unauthenticated scans helps identify the attack surface exposed to external threats and prioritizes vulnerabilities that are accessible from the internet.
* Tools: Common tools for unauthenticated scanning include Nessus, OpenVAS, and Nmap.
By performing an unauthenticated scan, the penetration tester can identify vulnerabilities that an external attacker could exploit without needing any credentials or internal access.