Standards and Methodology

How OpenVAPT lines up with the public frameworks that vulnerability assessments are judged against, and where it deliberately stops.

Methodology: NIST SP 800-115

NIST SP 800-115 describes four phases of a technical security assessment. OpenVAPT implements three and leaves the fourth out on purpose.

Phase	In OpenVAPT	Where in the Code
Planning	Scope is fixed in code to the machine the tool runs on. Rules of engagement are the EULA and the terms prompt at every scan.	`internal/scope`, `cmd/openvapt`
Discovery	Read-only collection: OS release, packages, sshd configuration, kernel parameters, listening sockets, local websites.	`internal/checks/collect`
Attack	Not implemented, by design. No exploitation, payloads, brute force or denial of service. This is what makes OpenVAPT an assessment, not a penetration test.	None
Reporting	Scope, methodology, findings with severity, evidence, remediation and verification, then limitations.	`internal/report`

Severity: CVSS v3.1

View as Table

Checks by Severity
Checks by Severity	Checks
Critical	14
High	73
Medium	89
Low	123
Info	11
Total	310

Every check carries a representative CVSS v3.1 base vector and the matching qualitative rating from the FIRST CVSS v3.1 specification: Critical 9.0-10.0, High 7.0-8.9, Medium 4.0-6.9, Low 0.1-3.9. The vector reflects a typical internet-facing server. Your own environment can raise or lower the real risk, which is why the report states this limitation.

Critical Checks

High Checks

Medium Checks

Low Checks

123

OWASP Top 10 (2021)

View as Table

Checks per OWASP Top 10 Category
Checks per OWASP Top 10 Category	Checks
A01:2021 Broken Access Control	9
A02:2021 Cryptographic Failures	31
A03:2021 Injection	2
A04:2021 Insecure Design	1
A05:2021 Security Misconfiguration	100
A06:2021 Vulnerable and Outdated Components	21
A07:2021 Identification and Authentication Failures	23
A08:2021 Software and Data Integrity Failures	3
A09:2021 Security Logging and Monitoring Failures	18
Total	208

Category	Checks
`A01:2021` Broken Access Control	HOST-K8S-001, NET-DB-023, WEB-APA-003, WEB-APP-006, WEB-CMS-019, WEB-COR-001, WEB-EXP-005, WEB-NGX-002, WEB-TOM-001
`A02:2021` Cryptographic Failures	HOST-PWD-001, HOST-PWD-002, HOST-SEC-001, HOST-SSH-004, NET-DB-013, NET-DB-016, NET-DB-019, NET-DB-020, NET-DB-022, NET-MAIL-001, NET-MAIL-002, NET-MAIL-004, NET-SVC-001, NET-TLS-001, NET-TLS-002, NET-TLS-003, NET-TLS-004, NET-TLS-005, NET-TLS-006, WEB-APA-005, WEB-APA-006, WEB-APA-007, WEB-APP-002, WEB-APP-004, WEB-APP-005, WEB-CMS-016, WEB-NGX-003, WEB-NGX-004, WEB-NGX-005, WEB-PY-003, WEB-TLS-001
`A03:2021` Injection	WEB-HDR-002, WEB-PHP-003
`A04:2021` Insecure Design	WEB-HDR-003
`A05:2021` Security Misconfiguration	HOST-CTR-001, HOST-SEC-001, HOST-SYSD-005, NET-AI-001, NET-AI-002, NET-APP-001, NET-APP-002, NET-DB-001, NET-DB-002, NET-DB-003, NET-DB-004, NET-DB-005, NET-DB-006, NET-DB-007, NET-DB-008, NET-DB-009, NET-DB-010, NET-DB-011, NET-DB-012, NET-DB-014, NET-DB-015, NET-DB-018, NET-DB-023, NET-DNS-001, NET-FW-003, NET-FW-005, NET-MAIL-003, NET-SVC-002, NET-SVC-004, WEB-APA-001, WEB-APA-002, WEB-APA-003, WEB-APA-004, WEB-APA-008, WEB-APA-009, WEB-APA-010, WEB-APA-011, WEB-APP-001, WEB-APP-002, WEB-APP-003, WEB-APP-004, WEB-APP-005, WEB-APP-006, WEB-APP-007, WEB-APP-009, WEB-APP-010, WEB-CK-001, WEB-CMS-001, WEB-CMS-004, WEB-CMS-005, WEB-CMS-006, WEB-CMS-007, WEB-CMS-009, WEB-CMS-010, WEB-CMS-011, WEB-CMS-013, WEB-CMS-015, WEB-CMS-016, WEB-CMS-017, WEB-CMS-019, WEB-COR-001, WEB-DOC-001, WEB-DOC-002, WEB-DOC-003, WEB-EXP-001, WEB-EXP-002, WEB-EXP-003, WEB-EXP-004, WEB-EXP-005, WEB-EXP-006, WEB-EXP-007, WEB-EXP-008, WEB-EXP-009, WEB-EXP-010, WEB-EXP-011, WEB-EXP-012, WEB-HDR-001, WEB-HDR-002, WEB-HDR-004, WEB-HDR-005, WEB-HDR-006, WEB-HDR-007, WEB-NGX-001, WEB-NGX-002, WEB-NGX-006, WEB-NGX-007, WEB-NODE-002, WEB-NODE-003, WEB-PHP-001, WEB-PHP-002, WEB-PHP-003, WEB-PY-001, WEB-PY-002, WEB-PY-003, WEB-PY-004, WEB-PY-005, WEB-TOM-001, WEB-TOM-003, WEB-TOM-004, WEB-TOM-005
`A06:2021` Vulnerable and Outdated Components	HOST-CVE-001, HOST-CVE-002, HOST-CVE-003, HOST-OS-001, HOST-PKG-001, HOST-PKG-004, HOST-PKG-005, HOST-PKG-006, HOST-UPD-001, WEB-APP-008, WEB-CMS-001, WEB-CMS-008, WEB-CMS-010, WEB-CMS-011, WEB-CMS-012, WEB-CMS-014, WEB-CVE-001, WEB-EXP-009, WEB-NODE-001, WEB-PHP-004, WEB-TOM-004
`A07:2021` Identification and Authentication Failures	HOST-CTR-001, HOST-IDS-001, HOST-K8S-001, HOST-PAM-001, HOST-PAM-002, HOST-PAM-004, HOST-PAM-005, HOST-PAM-006, HOST-PAM-009, HOST-PWD-003, HOST-PWD-004, NET-AI-001, NET-AI-002, NET-DB-019, NET-TLS-003, WEB-CK-001, WEB-CMS-002, WEB-CMS-003, WEB-CMS-018, WEB-EXP-011, WEB-NGX-006, WEB-PHP-005, WEB-TOM-002
`A08:2021` Software and Data Integrity Failures	HOST-PKG-002, HOST-PKG-003, NET-DNS-002
`A09:2021` Security Logging and Monitoring Failures	HOST-AUD-001, HOST-AUD-002, HOST-AUD-003, HOST-AUD-004, HOST-AUD-005, HOST-AUD-006, HOST-AUD-007, HOST-AUD-008, HOST-AUD-009, HOST-AUD-010, HOST-AUD-011, HOST-LOG-001, HOST-LOG-002, HOST-SSH-012, HOST-SUDO-001, NET-DB-017, NET-DB-021, WEB-EXP-008

Categories not listed (for example injection in application code or server-side request forgery) need manual testing or code review. See What It Does Not Do.

OWASP ASVS 4.0.3

Requirement	Checks
`V11.1.4`	WEB-APA-008, WEB-NGX-006
`V12.3.3`	WEB-PHP-003
`V12.5.1`	WEB-APA-010, WEB-APP-009, WEB-DOC-001, WEB-DOC-003, WEB-EXP-001, WEB-EXP-004, WEB-EXP-007, WEB-EXP-008, WEB-EXP-009, WEB-NGX-007
`V14.1.1`	WEB-APA-004
`V14.1.3`	NET-DB-014, NET-DB-015, NET-DB-018, NET-DB-023, WEB-APP-002, WEB-APP-004, WEB-APP-010
`V14.2.1`	WEB-APP-008, WEB-CMS-008, WEB-CMS-012, WEB-CMS-014, WEB-CVE-001, WEB-NODE-001, WEB-PHP-004
`V14.3.2`	WEB-APP-001, WEB-APP-003, WEB-APP-006, WEB-APP-007, WEB-CMS-006, WEB-CMS-009, WEB-CMS-015, WEB-EXP-002, WEB-EXP-003, WEB-EXP-006, WEB-EXP-012, WEB-NODE-002, WEB-NODE-003, WEB-PHP-001, WEB-PY-001, WEB-PY-004, WEB-PY-005
`V14.3.3`	WEB-APA-001, WEB-APA-009, WEB-APA-010, WEB-CMS-001, WEB-CMS-010, WEB-CMS-011, WEB-HDR-007, WEB-NGX-001, WEB-NGX-007, WEB-PHP-002
`V14.4.1`	WEB-CMS-013
`V14.4.3`	WEB-HDR-002
`V14.4.4`	WEB-HDR-004
`V14.4.5`	WEB-HDR-001
`V14.4.6`	WEB-HDR-005
`V14.4.7`	WEB-HDR-003
`V14.5.1`	WEB-APA-002
`V14.5.3`	WEB-COR-001
`V2.1.1`	WEB-TOM-002
`V2.10.4`	WEB-APP-001, WEB-APP-004, WEB-EXP-002, WEB-PY-003
`V2.2.1`	WEB-CMS-002
`V2.4.1`	NET-DB-019, NET-DB-022
`V2.5.4`	WEB-TOM-002
`V3.2.1`	WEB-PHP-005
`V3.4.1`	WEB-APP-005, WEB-CK-001
`V3.4.2`	WEB-CK-001, WEB-PHP-005
`V3.4.3`	WEB-CK-001
`V4.3.2`	WEB-APA-003, WEB-APP-006, WEB-CMS-019, WEB-EXP-005, WEB-NGX-002
`V7.1.1`	NET-DB-017
`V7.1.3`	NET-DB-021
`V7.4.1`	WEB-EXP-012
`V9.1.1`	NET-DB-013, WEB-APP-005, WEB-CMS-016, WEB-TLS-001
`V9.1.2`	WEB-APA-006, WEB-NGX-004
`V9.1.3`	NET-MAIL-002, NET-TLS-001, NET-TLS-004, WEB-APA-005, WEB-NGX-003
`V9.2.1`	NET-TLS-002, NET-TLS-003
`V9.2.2`	NET-DB-016, NET-DB-020, NET-MAIL-001, NET-MAIL-004
`V9.2.4`	WEB-APA-007, WEB-NGX-005

CWE Weaknesses

CWE	Checks
CWE-1004	WEB-CK-001, WEB-PHP-005
CWE-1021	WEB-HDR-002, WEB-HDR-003
CWE-1104	HOST-CVE-001, HOST-CVE-002, HOST-CVE-003, HOST-OS-001, HOST-PKG-001, HOST-PKG-004, HOST-PKG-005, HOST-PKG-006, HOST-UPD-001, HOST-UPD-002, WEB-APP-008, WEB-CMS-008, WEB-CMS-012, WEB-CMS-014, WEB-CVE-001, WEB-NODE-001, WEB-PHP-004
CWE-1188	HOST-BOOT-003, HOST-BOOT-004, HOST-BOOT-005, HOST-CTR-002, HOST-CTR-006, HOST-CTR-010, HOST-CTR-014, HOST-KRN-005, HOST-KRN-015, HOST-KRN-029, HOST-KRN-030, HOST-SSH-005, HOST-SVC-001, HOST-SVC-002, HOST-SVC-003, HOST-SVC-004, HOST-SVC-005, HOST-SVC-007, HOST-SVC-008, HOST-SVC-009, HOST-SVC-010, HOST-SVC-011, HOST-SVC-012, NET-APP-002, NET-DB-002, NET-DB-003, NET-DB-004, NET-DB-005, NET-DB-006, NET-DB-007, NET-FW-004, NET-SVC-004, WEB-APA-002, WEB-APA-004, WEB-APA-008, WEB-CMS-007, WEB-EXP-010, WEB-EXP-011, WEB-HDR-006, WEB-PY-005, WEB-SEC-001, WEB-TOM-001, WEB-TOM-003, WEB-TOM-005
CWE-1275	WEB-CK-001
CWE-1326	HOST-BOOT-002
CWE-1327	NET-AI-001, NET-APP-001, NET-APP-002, NET-DB-001, NET-FW-003, NET-FW-005, NET-LSN-001, NET-SVC-002, NET-SVC-004, WEB-TOM-004
CWE-1357	HOST-PKG-003
CWE-1392	WEB-TOM-002
CWE-1395	WEB-APP-008
CWE-15	HOST-SSH-011, WEB-APA-004
CWE-201	WEB-HDR-005
CWE-204	NET-MAIL-003, WEB-CMS-003, WEB-CMS-018
CWE-209	WEB-APP-001, WEB-CMS-006, WEB-CMS-009, WEB-CMS-015, WEB-EXP-012, WEB-NODE-003, WEB-PHP-001
CWE-215	WEB-APP-003, WEB-APP-007, WEB-PY-001
CWE-250	HOST-CTR-002, HOST-CTR-003, HOST-CTR-004, HOST-CTR-008, HOST-CTR-009, HOST-CTR-011, HOST-CTR-013, HOST-DKR-001, HOST-FS-004, HOST-FS-016, HOST-MAC-001, HOST-PAM-003, HOST-SSH-001, HOST-SSH-013, HOST-SYSD-001, HOST-SYSD-002, HOST-USR-001, HOST-USR-005, NET-DB-015
CWE-256	HOST-USR-007, HOST-USR-009, WEB-TOM-002
CWE-258	HOST-SSH-003, HOST-USR-002
CWE-260	WEB-CMS-004, WEB-EXP-002
CWE-262	HOST-PAM-004, HOST-PAM-005, HOST-PAM-006, HOST-PAM-007, HOST-PWD-005
CWE-266	HOST-DKR-001, HOST-USR-001
CWE-276	HOST-FS-008, HOST-FS-009, HOST-FS-010, HOST-FS-011, HOST-FS-013, HOST-FS-021, HOST-USR-010
CWE-282	HOST-FS-015
CWE-286	HOST-USR-004, HOST-USR-008
CWE-288	HOST-USR-006
CWE-290	HOST-SSH-011, HOST-USR-007, NET-DB-018
CWE-295	NET-TLS-003
CWE-297	NET-TLS-003
CWE-298	NET-TLS-002
CWE-299	WEB-APA-007, WEB-NGX-005
CWE-306	HOST-BOOT-001, HOST-CTR-001, HOST-CTR-014, HOST-K8S-001, HOST-SVC-004, HOST-SVC-008, HOST-USR-003, NET-AI-001, NET-AI-002, NET-DB-001, NET-DB-002, NET-DB-003, NET-DB-004, NET-DB-005, NET-DB-007, NET-DB-008, NET-DB-009, WEB-APP-006, WEB-CMS-019, WEB-EXP-011, WEB-NODE-002, WEB-TOM-004
CWE-307	HOST-IDS-001, HOST-PAM-002, HOST-PWD-004, HOST-SSH-002, HOST-SSH-006, HOST-SSH-008, WEB-CMS-002, WEB-NGX-006
CWE-308	HOST-SSH-008
CWE-312	HOST-SEC-001, HOST-SYSD-005, WEB-APP-002, WEB-APP-004, WEB-DOC-001
CWE-319	HOST-CTR-001, HOST-SVC-002, HOST-SVC-003, HOST-SVC-005, HOST-SVC-006, HOST-SVC-011, NET-DB-013, NET-DB-016, NET-DB-020, NET-MAIL-001, NET-MAIL-004, NET-SVC-001, WEB-APP-005, WEB-CMS-016, WEB-HDR-001, WEB-TLS-001
CWE-321	WEB-APP-001, WEB-APP-004, WEB-PY-003
CWE-326	NET-MAIL-002, NET-TLS-001, NET-TLS-004, NET-TLS-005, WEB-APA-005, WEB-NGX-003, WEB-NGX-005
CWE-327	HOST-SSH-004, NET-MAIL-002, NET-TLS-001, NET-TLS-004, NET-TLS-006, WEB-APA-005, WEB-APA-006, WEB-NGX-003, WEB-NGX-004
CWE-328	HOST-PWD-001, HOST-PWD-002, NET-DB-019, NET-DB-022
CWE-344	HOST-BOOT-007, HOST-KRN-001
CWE-346	WEB-CMS-013, WEB-PY-002
CWE-347	HOST-CTR-015, HOST-PKG-002, NET-DNS-002
CWE-350	NET-DB-018, NET-DNS-002
CWE-352	NET-AI-002
CWE-377	HOST-FS-002, HOST-FS-017
CWE-384	WEB-PHP-005
CWE-406	HOST-KRN-016, NET-DB-006, NET-DB-010, NET-SVC-003
CWE-426	HOST-CRON-001, HOST-CRON-002, HOST-PAM-008
CWE-427	HOST-CRON-002, HOST-PAM-008, HOST-SYSD-004
CWE-430	WEB-HDR-004
CWE-441	HOST-SSH-007, NET-DB-012
CWE-489	NET-APP-001, WEB-APP-001, WEB-APP-003, WEB-APP-007, WEB-CMS-006, WEB-CMS-009, WEB-CMS-015, WEB-EXP-012, WEB-NODE-002, WEB-NODE-003, WEB-PY-001, WEB-PY-004, WEB-PY-005
CWE-494	HOST-CTR-010, HOST-CTR-015, HOST-PKG-002
CWE-497	HOST-FS-018, HOST-KRN-002, HOST-KRN-003, NET-DB-011, NET-DNS-001, WEB-APA-001, WEB-APA-009, WEB-APP-006, WEB-CMS-001, WEB-CMS-010, WEB-CMS-011, WEB-EXP-003, WEB-EXP-006, WEB-EXP-010, WEB-HDR-007, WEB-NGX-001, WEB-PHP-002
CWE-521	HOST-PAM-001, HOST-PWD-003, HOST-SSH-002, HOST-USR-002, WEB-TOM-002
CWE-522	HOST-FS-022, HOST-SVC-006, HOST-USR-009
CWE-523	NET-DB-013, WEB-HDR-001
CWE-526	HOST-SYSD-005
CWE-527	WEB-APA-010, WEB-APP-009, WEB-EXP-001, WEB-EXP-007, WEB-NGX-007
CWE-528	HOST-BOOT-008, HOST-KRN-004
CWE-530	WEB-DOC-001, WEB-EXP-004
CWE-532	HOST-AUD-008, HOST-LOG-003, WEB-EXP-008
CWE-538	WEB-APA-010, WEB-APP-009, WEB-DOC-001, WEB-DOC-003, WEB-EXP-001, WEB-EXP-002, WEB-EXP-008, WEB-EXP-009, WEB-NGX-007
CWE-548	WEB-APA-003, WEB-EXP-005, WEB-NGX-002
CWE-552	WEB-DOC-003
CWE-59	HOST-KRN-011, HOST-KRN-012, HOST-KRN-020, HOST-KRN-021, NET-DB-014
CWE-613	HOST-PAM-009
CWE-614	WEB-APP-005, WEB-CK-001
CWE-644	WEB-CMS-013
CWE-653	HOST-CTR-003, HOST-CTR-011, HOST-SYSD-002
CWE-73	NET-DB-015
CWE-732	HOST-AUD-008, HOST-CRON-001, HOST-CTR-004, HOST-CTR-008, HOST-CTR-013, HOST-FS-001, HOST-FS-002, HOST-FS-003, HOST-FS-005, HOST-FS-006, HOST-FS-007, HOST-FS-014, HOST-FS-017, HOST-FS-018, HOST-FS-020, HOST-FS-022, HOST-K8S-002, HOST-K8S-003, HOST-SEC-001, HOST-SSH-009, HOST-SSH-010, HOST-SSH-013, HOST-SYSD-003, HOST-SYSD-004, HOST-USR-010, NET-DB-008, NET-DB-009, NET-DB-014, WEB-APP-002, WEB-APP-004, WEB-APP-010, WEB-CMS-004, WEB-CMS-005, WEB-DOC-002
CWE-749	HOST-KRN-009, HOST-KRN-010, HOST-KRN-018, HOST-KRN-019, HOST-KRN-022, HOST-KRN-027, HOST-KRN-028, HOST-KRN-031, NET-DB-023, WEB-APA-002
CWE-770	HOST-CTR-005, HOST-CTR-007, HOST-CTR-012, HOST-FS-012, HOST-KRN-008, HOST-LOG-004, WEB-APA-011, WEB-CMS-017, WEB-NGX-006
CWE-778	HOST-AUD-001, HOST-AUD-002, HOST-AUD-003, HOST-AUD-004, HOST-AUD-005, HOST-AUD-006, HOST-AUD-007, HOST-AUD-009, HOST-AUD-010, HOST-AUD-011, HOST-BOOT-006, HOST-KRN-014, HOST-LOG-001, HOST-LOG-002, HOST-SSH-012, HOST-SUDO-001, HOST-TIME-001, NET-DB-017, NET-DB-021
CWE-779	HOST-CTR-005, HOST-KRN-026
CWE-79	WEB-HDR-002
CWE-798	HOST-SEC-001, WEB-PY-003
CWE-862	HOST-FS-019, HOST-K8S-001, HOST-PAM-003
CWE-916	HOST-PWD-001, HOST-PWD-002, NET-DB-019, NET-DB-022
CWE-923	NET-FW-001, NET-FW-002, NET-FW-003, NET-FW-005, NET-FW-006, NET-SVC-002, WEB-TOM-001
CWE-94	WEB-APP-010, WEB-CMS-007, WEB-PY-004
CWE-940	HOST-KRN-006, HOST-KRN-007, HOST-KRN-013, HOST-KRN-017, HOST-KRN-023, HOST-KRN-024, HOST-KRN-025
CWE-942	WEB-COR-001
CWE-98	WEB-PHP-003

NIST SP 800-53 Rev. 5 Controls

Control	Checks
`AC-11`	HOST-PAM-009
`AC-12`	HOST-PAM-009
`AC-17`	HOST-SSH-013, NET-SVC-002, NET-SVC-004
`AC-2`	HOST-FS-015, HOST-USR-001, HOST-USR-004, HOST-USR-005, HOST-USR-008, HOST-USR-009
`AC-2(3)`	HOST-PAM-007
`AC-2(4)`	HOST-AUD-002, NET-DB-021
`AC-3`	HOST-BOOT-001, HOST-CRON-001, HOST-CTR-001, HOST-CTR-008, HOST-CTR-014, HOST-FS-001, HOST-FS-002, HOST-FS-003, HOST-FS-005, HOST-FS-006, HOST-FS-007, HOST-FS-014, HOST-FS-017, HOST-FS-018, HOST-FS-020, HOST-FS-022, HOST-K8S-001, HOST-K8S-002, HOST-K8S-003, HOST-LOG-003, HOST-PAM-003, HOST-SEC-001, HOST-SSH-009, HOST-SSH-010, HOST-SYSD-003, HOST-SYSD-004, HOST-USR-008, HOST-USR-010, NET-AI-001, NET-AI-002, NET-DB-002, NET-DB-003, NET-DB-004, NET-DB-005, NET-DB-007, NET-DB-008, NET-DB-009, NET-DB-011, NET-DB-012, WEB-APA-003, WEB-APP-002, WEB-APP-004, WEB-APP-006, WEB-APP-010, WEB-CMS-004, WEB-CMS-005, WEB-CMS-019, WEB-DOC-002, WEB-EXP-005, WEB-EXP-011, WEB-NGX-002, WEB-TOM-001, WEB-TOM-004
`AC-3(3)`	HOST-MAC-001
`AC-4`	HOST-SSH-007, NET-FW-003, WEB-COR-001
`AC-6`	HOST-AUD-008, HOST-BOOT-001, HOST-BOOT-008, HOST-CRON-001, HOST-CRON-002, HOST-CTR-002, HOST-CTR-003, HOST-CTR-004, HOST-CTR-008, HOST-CTR-009, HOST-CTR-011, HOST-CTR-013, HOST-DKR-001, HOST-FS-001, HOST-FS-004, HOST-FS-006, HOST-FS-007, HOST-FS-009, HOST-FS-014, HOST-FS-015, HOST-FS-016, HOST-FS-018, HOST-FS-019, HOST-FS-020, HOST-FS-021, HOST-FS-022, HOST-K8S-003, HOST-KRN-003, HOST-KRN-004, HOST-KRN-010, HOST-KRN-011, HOST-KRN-012, HOST-KRN-019, HOST-KRN-020, HOST-KRN-021, HOST-KRN-027, HOST-KRN-028, HOST-KRN-029, HOST-KRN-031, HOST-LOG-003, HOST-MAC-001, HOST-PAM-008, HOST-SSH-009, HOST-SSH-010, HOST-SSH-013, HOST-SYSD-001, HOST-SYSD-002, HOST-USR-001, HOST-USR-003, HOST-USR-010, NET-DB-014, NET-DB-015, NET-DB-023, WEB-APP-010, WEB-CMS-007, WEB-DOC-002
`AC-6(2)`	HOST-PAM-003, HOST-SSH-001
`AC-6(9)`	HOST-AUD-006
`AC-7`	HOST-AUD-003, HOST-IDS-001, HOST-PAM-002, HOST-PWD-004, HOST-SSH-006, HOST-SSH-008, WEB-CMS-002, WEB-NGX-006
`AU-11`	HOST-AUD-010, HOST-LOG-001, HOST-LOG-004
`AU-12`	HOST-AUD-001, HOST-AUD-002, HOST-AUD-003, HOST-AUD-004, HOST-AUD-005, HOST-AUD-006, HOST-AUD-007, HOST-LOG-002, HOST-SUDO-001, NET-DB-017, NET-DB-021
`AU-2`	HOST-AUD-001, HOST-AUD-002, HOST-AUD-003, HOST-AUD-004, HOST-AUD-005, HOST-AUD-006, HOST-LOG-001, HOST-LOG-002, HOST-SSH-012, HOST-SUDO-001, NET-DB-017, NET-DB-021
`AU-3`	HOST-SSH-012
`AU-4`	HOST-AUD-009, HOST-AUD-010, HOST-CTR-005, HOST-LOG-004
`AU-5`	HOST-AUD-009
`AU-6`	HOST-AUD-011
`AU-8`	HOST-AUD-004, HOST-TIME-001
`AU-9`	HOST-AUD-007, HOST-AUD-008, HOST-AUD-010, HOST-LOG-001
`AU-9(2)`	HOST-AUD-011
`CM-14`	HOST-CTR-015, HOST-PKG-002
`CM-3`	HOST-BOOT-006, NET-FW-004
`CM-5`	HOST-CRON-001, HOST-SYSD-003, HOST-SYSD-004, WEB-APP-010, WEB-CMS-005
`CM-6`	HOST-BOOT-001, HOST-BOOT-002, HOST-BOOT-003, HOST-BOOT-008, HOST-CRON-002, HOST-CTR-002, HOST-CTR-005, HOST-CTR-006, HOST-CTR-007, HOST-CTR-008, HOST-CTR-014, HOST-FS-003, HOST-FS-005, HOST-FS-008, HOST-FS-009, HOST-FS-010, HOST-FS-011, HOST-FS-012, HOST-FS-013, HOST-FS-014, HOST-FS-015, HOST-FS-017, HOST-FS-021, HOST-KRN-001, HOST-KRN-002, HOST-KRN-003, HOST-KRN-004, HOST-KRN-005, HOST-KRN-006, HOST-KRN-007, HOST-KRN-008, HOST-KRN-009, HOST-KRN-010, HOST-KRN-011, HOST-KRN-012, HOST-KRN-013, HOST-KRN-014, HOST-KRN-015, HOST-KRN-016, HOST-KRN-017, HOST-KRN-018, HOST-KRN-019, HOST-KRN-020, HOST-KRN-021, HOST-KRN-022, HOST-KRN-023, HOST-KRN-024, HOST-KRN-025, HOST-KRN-026, HOST-KRN-027, HOST-KRN-028, HOST-KRN-029, HOST-KRN-030, HOST-KRN-031, HOST-PAM-008, HOST-SSH-011, HOST-SYSD-002, HOST-USR-007, NET-DB-002, NET-DB-003, NET-DB-004, NET-DB-005, NET-DB-006, NET-DB-007, NET-DB-008, NET-DB-009, NET-DB-010, NET-DB-011, NET-DB-012, NET-DB-014, NET-DB-015, NET-DB-018, NET-DNS-001, WEB-APA-001, WEB-APA-004, WEB-APA-009, WEB-APA-011, WEB-APP-001, WEB-APP-003, WEB-APP-005, WEB-APP-007, WEB-CMS-003, WEB-CMS-013, WEB-CMS-015, WEB-CMS-016, WEB-CMS-018, WEB-CMS-019, WEB-COR-001, WEB-DOC-001, WEB-DOC-003, WEB-HDR-004, WEB-HDR-005, WEB-HDR-006, WEB-NGX-001, WEB-NODE-002, WEB-NODE-003, WEB-PHP-001, WEB-PHP-003, WEB-PHP-005, WEB-PY-001, WEB-PY-002, WEB-PY-004, WEB-TOM-003
`CM-7`	HOST-AUD-005, HOST-BOOT-003, HOST-BOOT-004, HOST-BOOT-005, HOST-BOOT-007, HOST-CRON-002, HOST-CTR-006, HOST-CTR-010, HOST-CTR-011, HOST-CTR-013, HOST-FS-004, HOST-FS-008, HOST-FS-010, HOST-FS-011, HOST-FS-012, HOST-FS-013, HOST-FS-016, HOST-FS-019, HOST-KRN-022, HOST-PKG-004, HOST-SSH-005, HOST-SSH-007, HOST-SVC-001, HOST-SVC-002, HOST-SVC-003, HOST-SVC-004, HOST-SVC-005, HOST-SVC-006, HOST-SVC-007, HOST-SVC-008, HOST-SVC-009, HOST-SVC-010, HOST-SVC-011, HOST-SVC-012, HOST-SYSD-001, HOST-USR-005, HOST-USR-006, NET-AI-001, NET-APP-001, NET-APP-002, NET-DB-001, NET-DB-023, NET-FW-003, NET-FW-004, NET-FW-005, NET-FW-006, NET-LSN-001, NET-MAIL-003, NET-SVC-001, NET-SVC-002, NET-SVC-004, WEB-APA-002, WEB-APA-003, WEB-APA-004, WEB-APA-010, WEB-APP-006, WEB-APP-007, WEB-APP-009, WEB-CMS-001, WEB-CMS-002, WEB-CMS-007, WEB-CMS-017, WEB-EXP-001, WEB-EXP-002, WEB-EXP-003, WEB-EXP-004, WEB-EXP-005, WEB-EXP-006, WEB-EXP-007, WEB-EXP-008, WEB-EXP-009, WEB-EXP-010, WEB-EXP-011, WEB-EXP-012, WEB-HDR-006, WEB-HDR-007, WEB-NGX-002, WEB-NGX-007, WEB-NODE-002, WEB-PHP-002, WEB-PHP-003, WEB-PY-004, WEB-PY-005, WEB-TOM-001, WEB-TOM-003, WEB-TOM-004, WEB-TOM-005
`CM-7(1)`	HOST-SVC-002, HOST-SVC-003, HOST-SVC-004, HOST-SVC-005, HOST-SVC-006, HOST-SVC-007, HOST-SVC-008, HOST-SVC-009, HOST-SVC-010, HOST-SVC-011, HOST-SVC-012
`CM-8`	HOST-PKG-003, NET-FW-006, NET-LSN-001
`IA-11`	HOST-USR-003
`IA-2`	HOST-K8S-001, HOST-SSH-001, HOST-SSH-008, HOST-SSH-011, HOST-USR-004, HOST-USR-006, NET-AI-002
`IA-2(1)`	HOST-SSH-002
`IA-3`	NET-DB-018
`IA-5`	HOST-FS-022, HOST-SEC-001, HOST-SSH-002, HOST-SSH-013, HOST-SYSD-005, HOST-USR-002, HOST-USR-007, HOST-USR-009, NET-DB-019, WEB-APP-001, WEB-APP-004, WEB-PY-003, WEB-TOM-002
`IA-5(1)`	HOST-PAM-001, HOST-PAM-004, HOST-PAM-005, HOST-PAM-006, HOST-PWD-001, HOST-PWD-002, HOST-PWD-003, HOST-PWD-005, HOST-SSH-003, NET-DB-013, NET-DB-019, NET-DB-022
`MP-7`	HOST-BOOT-004
`RA-5`	HOST-CVE-001, HOST-CVE-002, HOST-CVE-003, HOST-PKG-001, HOST-PKG-005, HOST-PKG-006, WEB-CVE-001
`RA-5(11)`	WEB-SEC-001
`SA-22`	HOST-OS-001, WEB-APP-008, WEB-CMS-012, WEB-CMS-014, WEB-NODE-001
`SC-12`	NET-TLS-002, NET-TLS-005, NET-TLS-006, WEB-PY-003
`SC-13`	HOST-SSH-004, NET-DB-016, NET-DB-019, NET-DB-020, NET-DB-022, NET-MAIL-001, NET-MAIL-002, NET-MAIL-004, NET-TLS-001, NET-TLS-004, NET-TLS-005, NET-TLS-006, WEB-APA-005, WEB-APA-006, WEB-NGX-003, WEB-NGX-004
`SC-17`	NET-TLS-002, NET-TLS-003, WEB-APA-007, WEB-NGX-005
`SC-18`	WEB-HDR-003
`SC-20`	NET-DNS-002
`SC-21`	NET-DNS-002
`SC-23`	WEB-CK-001, WEB-PHP-005
`SC-28`	HOST-K8S-002, HOST-SEC-001, HOST-SYSD-005, WEB-APA-010, WEB-APP-002, WEB-APP-004, WEB-APP-009, WEB-CMS-004, WEB-DOC-001, WEB-DOC-003, WEB-EXP-001, WEB-EXP-002, WEB-EXP-004, WEB-EXP-007, WEB-EXP-008, WEB-NGX-007
`SC-39`	HOST-CTR-003, HOST-CTR-004, HOST-CTR-009, HOST-CTR-011, HOST-SYSD-002
`SC-5`	HOST-CTR-005, HOST-CTR-012, HOST-FS-010, HOST-FS-011, HOST-FS-012, HOST-KRN-008, HOST-KRN-016, NET-DB-006, NET-DB-010, NET-SVC-003, WEB-APA-008, WEB-APA-011, WEB-CMS-017, WEB-NGX-006
`SC-6`	HOST-CTR-007, HOST-CTR-012
`SC-7`	HOST-KRN-005, HOST-KRN-006, HOST-KRN-007, HOST-KRN-013, HOST-KRN-014, HOST-KRN-015, HOST-KRN-017, HOST-KRN-023, HOST-KRN-024, HOST-KRN-025, HOST-KRN-026, HOST-KRN-030, NET-AI-001, NET-APP-001, NET-APP-002, NET-DB-001, NET-DB-002, NET-DB-003, NET-DB-004, NET-DB-005, NET-DB-006, NET-DB-007, NET-DB-008, NET-DB-009, NET-DB-010, NET-DB-011, NET-DB-012, NET-FW-001, NET-FW-002, NET-FW-003, NET-FW-004, NET-FW-005, NET-FW-006, NET-SVC-002, NET-SVC-003, NET-SVC-004, WEB-TOM-004
`SC-8`	HOST-CTR-001, HOST-CTR-014, HOST-SSH-004, HOST-SVC-002, HOST-SVC-003, HOST-SVC-004, HOST-SVC-005, HOST-SVC-006, NET-DB-013, NET-DB-016, NET-DB-020, NET-MAIL-001, NET-MAIL-002, NET-MAIL-004, NET-SVC-001, NET-TLS-001, NET-TLS-004, WEB-APA-005, WEB-APA-006, WEB-APA-007, WEB-APP-005, WEB-CK-001, WEB-CMS-016, WEB-HDR-001, WEB-NGX-003, WEB-NGX-004, WEB-NGX-005, WEB-TLS-001
`SI-10`	NET-DB-015, WEB-APA-008, WEB-CMS-013, WEB-HDR-002, WEB-PY-002
`SI-11`	HOST-BOOT-008, NET-DNS-001, NET-MAIL-003, WEB-APA-001, WEB-APA-009, WEB-APP-001, WEB-APP-003, WEB-APP-006, WEB-CMS-001, WEB-CMS-003, WEB-CMS-006, WEB-CMS-009, WEB-CMS-010, WEB-CMS-011, WEB-CMS-015, WEB-CMS-018, WEB-EXP-003, WEB-EXP-006, WEB-EXP-012, WEB-HDR-007, WEB-NGX-001, WEB-PHP-001, WEB-PHP-002
`SI-16`	HOST-KRN-001, HOST-KRN-002, HOST-KRN-009, HOST-KRN-018
`SI-2`	HOST-CVE-001, HOST-CVE-002, HOST-CVE-003, HOST-OS-001, HOST-PKG-001, HOST-PKG-004, HOST-PKG-005, HOST-PKG-006, HOST-UPD-002, WEB-APP-008, WEB-CMS-008, WEB-CMS-012, WEB-CMS-014, WEB-CVE-001, WEB-NODE-001, WEB-PHP-004
`SI-2(2)`	HOST-UPD-001
`SI-4`	HOST-AUD-011, HOST-IDS-001
`SI-7`	HOST-BOOT-002, HOST-BOOT-005, HOST-BOOT-006, HOST-BOOT-007, HOST-CTR-010, HOST-CTR-015, HOST-PKG-002
`SR-11`	HOST-PKG-002
`SR-3`	HOST-PKG-002, HOST-PKG-003
`SR-4`	HOST-PKG-003

Report Formats

Reports follow the structure recommended in NIST SP 800-115 section 8 and are written in open formats: self-contained HTML (prints to PDF), JSON (schema openvapt.report/1), OASIS SARIF 2.1.0 for code-scanning tools, and Markdown.

Benchmarks and Copyright

Some checks cover the same topics as CIS Benchmarks. OpenVAPT names the topic only and writes its own explanations; it does not copy benchmark text, which is licensed by CIS.

Cite This Work: OpenVAPT. (2026). OpenVAPT: An open academic vulnerability assessment tool (Version 0.1.0-alpha.6) [Computer software]. https://github.com/OpenVAPT/openvapt