Every network is a collection of doors — open ports, running services, web apps, user accounts. Vulnerability detection is the discipline of finding the doors that are unlocked, propped open, or fitted with a broken latch, and doing it before someone with bad intentions walks through. In this guide we’ll work through the main categories of detection, the specific tools that do the job, and exactly how you’d run each one in a home lab.

01 / SCANNINGAutomated vulnerability scanning

Vulnerability scanners are the workhorses of detection. They connect to hosts, enumerate the services running on them, and compare what they find against a database of known flaws — the CVEs (Common Vulnerabilities and Exposures). The output is a prioritized report: missing patches, weak configurations, exposed services, each usually scored with a CVSS severity rating.

02 / DISCOVERYPort scanning & service enumeration

Before you can assess a service, you have to know it’s there. Port scanning maps which ports are open, which services are listening, and often which operating system a host is running. An unexpected open port — Telnet on 23, SMB on 445, an admin panel on 8080 — is frequently the very first thread you pull.

# Ping sweep — which hosts are alive on the subnet?
nmap -sn 192.168.222.0/24

# Service + version detection on a single target
nmap -sV 192.168.222.134

# Aggressive: OS detect, versions, scripts, traceroute
nmap -A 192.168.222.134

# Run the vuln script category via NSE
nmap --script vuln 192.168.222.134

03 / TRAFFICPacket analysis & network monitoring

Some vulnerabilities never show up in a scanner report — they live in the traffic. Cleartext credentials, unencrypted protocols, odd outbound connections, misconfigured services chattering on the wire. Packet analysis is how you see them.

# Only HTTP traffic
http

# Traffic to/from one host
ip.addr == 192.168.222.137

# Catch cleartext FTP/Telnet logins
ftp || telnet

# Follow a full TCP conversation: right-click → Follow → TCP Stream

# Capture on eth0, write to a file for later analysis
tcpdump -i eth0 -w capture.pcap

# Only port 80 traffic, printed live
tcpdump -i eth0 port 80

04 / MONITORINGIntrusion detection systems (IDS)

Scanners find weaknesses at a point in time. An IDS watches continuously, comparing live traffic against rule sets and raising alerts when it sees exploit attempts, malware signatures, or policy violations. This is detection as an ongoing sensor, not a one-off audit.

# Test the config and rules
suricata -T -c /etc/suricata/suricata.yaml

# Run against a live interface
suricata -c /etc/suricata/suricata.yaml -i eth0

# Watch the alerts roll in
tail -f /var/log/suricata/fast.log

05 / WEBWeb application scanning

Web apps are their own attack surface, and general network scanners only scratch it. Dedicated web scanners probe for the classic weaknesses — the kind catalogued in the OWASP Top 10: injection, cross-site scripting (XSS), security misconfiguration, and more.

# Scan a target web server
nikto -h http://192.168.222.134

06 / HARDENINGConfiguration & patch auditing

Not every vulnerability is a missing patch — many are insecure defaults: weak permissions, unnecessary services, exposed management interfaces. Configuration auditing checks systems against a known-good hardening standard. (For a worked example on a real environment, see our guide on securing a Windows Active Directory environment.)

07 / VALIDATIONConfirming findings with exploitation

Detection tells you a vulnerability might exist. Penetration testing confirms whether it’s genuinely exploitable — separating the theoretical from the dangerous. This is where a scanner finding becomes a proven risk.

08 / AFTER THE BREACHDetecting post-exploitation activity on web servers

Detection doesn’t stop at the front door. If an attacker has already gotten in — through an unpatched web server, a stolen credential, a vulnerable upload form — everything they do next leaves traces. Post-exploitation is the phase after initial access: escalating privileges, planting a way back in, harvesting credentials, moving deeper into the network, and quietly removing the evidence. Knowing what those activities look like is what lets you catch a breach that your perimeter scanners already missed.

# Build the baseline database of known-good files
sudo aideinit

# Compare the live filesystem against that baseline
sudo aide --check

# Quick manual check: anything written to the web root in the last day?
find /var/www/html -type f -mtime -1 -ls

# Classic web shell tells — code execution functions in a PHP file
grep -rniE --include=*.php "eval\(|base64_decode\(|shell_exec\(" /var/www/html

# Alert on any write or attribute change inside the web root
sudo auditctl -w /var/www/html -p wa -k webroot_change

# Review what that rule caught
sudo ausearch -k webroot_change -i

# Authentication history — successes and failures
grep -E "Accepted|Failed password" /var/log/auth.log

# Persistence sweep: cron, timers, and stray SSH keys
sudo ls -la /etc/cron.* /var/spool/cron/crontabs/
sudo systemctl list-timers --all
sudo find /home /root -name authorized_keys -ls

# Unexpected SUID binaries — a common escalation path
sudo find / -perm -4000 -type f 2>/dev/null

# What connections is this host holding open, and which process owns them?
sudo ss -tunp | grep ESTAB

# Live view of anything leaving the box that isn't normal web traffic
sudo tcpdump -i eth0 -n 'not port 80 and not port 443'

# Reverse-shell and C2 signatures firing in the IDS
grep -iE "shell|trojan|exfil" /var/log/suricata/fast.log

The broader lesson is defense in depth. Initial compromise of an internet-facing web server is a bad day; it shouldn’t be a catastrophic one. Segmentation, least privilege, egress filtering, and monitoring are what stop a single foothold from becoming full network compromise — and every one of them also produces the signal that tells you the foothold exists.

09 / INTELLIGENCEPopular threat intelligence websites

Finding a vulnerability is half the job — understanding it is the other half. Threat intelligence sources let you look up a CVE, check an indicator, score a severity, and learn how real adversaries are using a given weakness. These are the references analysts keep bookmarked.

10 / WORKFLOWPutting it together

The tools above aren’t rivals — they’re a pipeline. A realistic detection flow chains them together, each stage feeding the next:

Run that loop against a lab target like Metasploitable and you’ll have touched every category of network vulnerability detection — from first packet to confirmed finding. To go further and bake this kind of security testing into a development pipeline, see our beginner’s guide to DevSecOps.

FAQCommon questions