--- title: "F2: What VAPT Is, and Doing It Legally" canonical: https://openvapt.com/academy/f2.html html: https://openvapt.com/academy/f2.html site: OpenVAPT, https://openvapt.com/ license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html modified: 2026-10-16 version: 0.1.0-alpha.6 --- # F2: What VAPT Is, and Doing It Legally How vulnerability assessment and penetration testing differ, how professional assessments are structured, and why authorisation is the first rule. - Level: Foundations - Time: about 20 minutes - Read first: F1 ## You Will Be Able To - Explain the difference between vulnerability assessment and penetration testing. - Describe the phases of NIST SP 800-115 and where OpenVAPT stops. - Explain why written authorisation and scope come before any testing. ## VA Versus PT A vulnerability assessment (VA) looks for known weaknesses and rates them, without exploiting anything. A penetration test (PT) is performed by skilled, authorised testers. They try to exploit weaknesses to prove real impact and to find chains a scanner cannot see. VAPT combines both. OpenVAPT teaches and performs only the VA part, automatically, on one machine. That is a deliberate design choice, not a missing feature. ## Methodologies NIST SP 800-115 describes four phases: planning, discovery, attack and reporting. Other widely used frameworks include the Penetration Testing Execution Standard (PTES), the OWASP Web Security Testing Guide (WSTG) for web applications, and OSSTMM. OpenVAPT implements planning (scope fixed in code), discovery (read-only collection), analysis (checks) and reporting. The attack phase is absent by design. ## Authorisation, Scope and the Law Testing a system without permission is a crime in most countries. Examples include the Computer Fraud and Abuse Act in the United States and the Computer Misuse Act 1990 in the United Kingdom. Others are Directive 2013/40/EU in the European Union and the Computer Crimes Act 1997 in Malaysia. The Council of Europe Convention on Cybercrime has been joined by many countries. Some countries also license people who sell security testing as a service. Always follow the law where you and the machine are. Professional testers work only with written authorisation that defines scope, timing and rules of engagement. OpenVAPT enforces the strictest possible scope in code: the machine it runs on and nothing else. Even so, you need the right to run it on that machine. ## In Summary A vulnerability assessment finds and rates weaknesses. A penetration test also exploits them. Both need written authorisation and a clear scope. OpenVAPT assesses only the machine it runs on. ## Apply It - [NET-LSN-001 Inventory of Listening Network Services](https://openvapt.com/checks/NET-LSN-001.md) (info) ## Lab 1. `Run: openvapt scan --dry-run and read every operation it would perform.` 2. `Find the loopback guard in internal/scope/scope.go and its test. Explain why host names are refused.` 3. `Write a one-paragraph scope statement for assessing your own test server.` ## Check Yourself Answer keys are public for every channel (see Teaching With OpenVAPT). 1. What does a penetration test do that a vulnerability assessment does not? - A. Rates findings by severity - B. Attempts to exploit weaknesses to prove impact - C. Produces a report - D. Looks for known weaknesses - Answer: B. Both look for weaknesses, rate them and report. Exploitation to demonstrate real impact is the defining activity of a penetration test. 2. Which NIST SP 800-115 phase does OpenVAPT deliberately leave out? - A. Discovery - B. Reporting - C. Attack - D. Planning - Answer: C. NIST SP 800-115 names planning, discovery, attack and reporting. OpenVAPT is detection only and never attacks. 3. What must exist before testing a system you do not own? - A. A fast internet connection - B. Written authorisation with a defined scope - C. A paid scanner licence - D. A tool that is free to use - Answer: B. Authorisation and scope come first, always. The tool or its price does not give you the right to test. 4. Which scope does OpenVAPT enforce in its code? - A. Any host on the local network - B. Only the machine it runs on - C. Any host named on the command line - D. Any host covered by written authorisation - Answer: B. The loopback guard limits OpenVAPT to the machine it runs on and nothing else, even if you have permission for other hosts. 5. Which of these is a methodology for testing web applications? - A. OWASP Web Security Testing Guide (WSTG) - B. CVSS v3.1 - C. CWE - D. Directive 2013/40/EU - Answer: A. The WSTG is a testing methodology for web applications. CVSS rates severity, CWE classifies weakness types and the directive is European Union law. 6. You run OpenVAPT on a server you rent but do not control. Does its loopback-only scope make the test lawful? - A. Yes, local scans are always lawful - B. No, you still need the right to run it on that machine - C. Yes, if the server is in another country - D. Only if the scan finishes quickly - Answer: B. Scope limits what the tool touches. It does not grant permission. You still need the right to run it on that machine, under the law where you and the machine are. ## Key Terms - VAPT: Vulnerability Assessment and Penetration Testing: finding and rating weaknesses, then proving their impact. - Vulnerability Assessment: Finding and rating known weaknesses without exploiting them. - Penetration Testing: Authorised testing that tries to exploit weaknesses to demonstrate real impact. - Scope: The exact systems and activities an assessment is allowed to cover. - Rules of Engagement: The agreed rules for a security test: what may be tested, when, how and by whom. - NIST SP 800-115: A NIST guide describing how to plan, perform and report technical security testing and assessment. - False Positive: A reported problem that is not real. ## References - [NIST SP 800-115, Technical Guide to Information Security Testing and Assessment](https://csrc.nist.gov/pubs/sp/800/115/final) - [OWASP Web Security Testing Guide](https://owasp.org/projects/web-security-testing-guide) - [Penetration Testing Execution Standard (PTES) Technical Guidelines](https://pentest-standard.readthedocs.io/en/latest/) Offline: `openvapt learn F2`. --- OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/academy/f2.html. Part of OpenVAPT Academy. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.