Penetration Testing with Kali Linux OffSec

threat actor
,
25
a 
term signifying agency, motivation, and intelligence. We’ll learn more about different kinds of 
threat actors in the next section. 
For a threat to become an actual risk, the target being threatened must be 
vulnerable
in some 
manner. A 
vulnerability
26
is a flaw that allows a threat to cause harm. Not all flaws are 
vulnerabilities. To take a non-security example, let’s imagine a bridge. A bridge can have some 
aesthetic flaws; maybe some pavers are scratched or it isn’t perfectly straight. However, these 
flaws aren’t vulnerabilities because they don’t pose any risk of damage to the bridge. Alternatively, 
if the bridge 
does
have structural flaws in its construction, it may be vulnerable to specific threats 
such as overloading or too much wind. 
Let’s dive into an example. In 
December 2021
27
, a vulnerability was discovered in the 
Apache 
Log4J
28
library, a popular Java-based logging library. This vulnerability could lead to arbitrary code 
execution by taking advantage of a 
JNDI Java toolkit
feature which, by default, allowed for 
download requests to enrich logging. If a valid Java file was downloaded, this program would be 
executed by the server. This means that if user-supplied input (such as a username or HTTP 
header) was improperly sanitized before being logged, it was possible to make the server 
download a malicious Java file that would allow a remote, unauthorized user to execute 
commands on the server. 
Due to the popularity of the Log4j library, this vulnerability was given the highest possible rating 
under the 
Common Vulnerability Scoring System
(CVSS)
29
used to score vulnerabilities: 10.0 
Critical. This rating led to a frenzied aftermath including vendors, companies, and individuals 
scrambling to identify and patch vulnerable systems as well as search for indications of 
compromise. Additional Log4J vulnerabilities were discovered soon after, exacerbating matters. 
This vulnerability could have been prevented by ensuring that user-supplied data is properly 
sanitized
.
30
The issue could have been mitigated by ensuring that potentially dangerous features 
(such as allowing web-requests and code execution) were disabled by default. 
In computer programs, vulnerabilities occur when someone who interacts with the program can 
achieve specific objectives that are unintended by the programmer. When these objectives 
24
(NIST, 2022), https://csrc.nist.gov/glossary/term/cyber_threat 
25
(NIST, 2022), https://csrc.nist.gov/glossary/term/threat_actor 
26
(NIST, 2022), https://csrc.nist.gov/glossary/term/vulnerability 
27
(NakedSecurity - Sophos, 2021), https://nakedsecurity.sophos.com/2021/12/10/log4shell-java-vulnerability-how-to-safeguard-your-
servers/ 
28
(Apache, 2022), https://logging.apache.org/log4j/2.x/ 
29
(NIST, 2022), https://nvd.nist.gov/vuln-metrics/cvss 
30
(Webopedia, 2021), https://www.webopedia.com/definitions/input-sanitization/ 

---

Penetration Testing with Kali Linux
PWK - Copyright © 2023 OffSec Services Limited. All rights reserved. 
36 
provide the user with access or privileges that they aren’t supposed to have, and when they are 
pursued deliberately and maliciously, the user’s actions become an 
exploit
.
31
The word 
exploit
in cybersecurity can be used as both a noun and as a verb. As a noun, an exploit 
is a procedure for abusing a particular vulnerability. As a verb, to exploit a vulnerability is to 
perform the procedure that reliably abuses it. 
Let’s wrap up this section by exploring attack surfaces and vectors. An