What VAPT Is, and Doing It Legally

VA Versus PT

A vulnerability assessment (VA) looks for known weaknesses and rates them, without exploiting anything. A penetration test (PT) is performed by skilled, authorised testers. They try to exploit weaknesses to prove real impact and to find chains a scanner cannot see.

VAPT combines both. OpenVAPT teaches and performs only the VA part, automatically, on one machine. That is a deliberate design choice, not a missing feature.

Methodologies

NIST SP 800-115 describes four phases: planning, discovery, attack and reporting. Other widely used frameworks include the Penetration Testing Execution Standard (PTES), the OWASP Web Security Testing Guide (WSTG) for web applications, and OSSTMM.

OpenVAPT implements planning (scope fixed in code), discovery (read-only collection), analysis (checks) and reporting. The attack phase is absent by design.

Authorisation, Scope and the Law

Testing a system without permission is a crime in most countries. Examples include the Computer Fraud and Abuse Act in the United States and the Computer Misuse Act 1990 in the United Kingdom. Others are Directive 2013/40/EU in the European Union and the Computer Crimes Act 1997 in Malaysia. The Council of Europe Convention on Cybercrime has been joined by many countries. Some countries also license people who sell security testing as a service. Always follow the law where you and the machine are.

Professional testers work only with written authorisation that defines scope, timing and rules of engagement. OpenVAPT enforces the strictest possible scope in code: the machine it runs on and nothing else. Even so, you need the right to run it on that machine.

In Summary

A vulnerability assessment finds and rates weaknesses. A penetration test also exploits them. Both need written authorisation and a clear scope. OpenVAPT assesses only the machine it runs on.

Apply It

These OpenVAPT checks put this module into practice. Open one to see its detection logic and source code.

Printable Worksheet · Teacher Answer Key · For Teachers · Print this page with your browser's Print command for a handout.

Also available as plain Markdown for notes, scripts and AI tools. Same facts, same source, no styling.

Lab

1. Run: openvapt scan --dry-run and read every operation it would perform.
2. Find the loopback guard in internal/scope/scope.go and its test. Explain why host names are refused.
3. Write a one-paragraph scope statement for assessing your own test server.

Check Yourself

Answers are checked in your browser and never stored or sent.

References

• NIST SP 800-115, Technical Guide to Information Security Testing and Assessment
• OWASP Web Security Testing Guide
• Penetration Testing Execution Standard (PTES) Technical Guidelines

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under Teaching With OpenVAPT. Pre-release material may be wrong or unstable; use at your own risk.

OpenVAPT. (2026). F2: What VAPT Is, and Doing It Legally (Version 0.1.0-alpha.6). OpenVAPT Academy. Retrieved October 16, 2026, from https://openvapt.com/academy/f2.html

@misc{openvapt_f2,
  author       = {{OpenVAPT}},
  title        = {{F2: What VAPT Is, and Doing It Legally}},
  year         = {2026},
  howpublished = {\url{https://openvapt.com/academy/f2.html}},
  note         = {OpenVAPT Academy, version 0.1.0-alpha.6. Accessed 16 October 2026}
}