Not all vulnerabilities are going to be identified in the CVE database or known
exploit database that you choose.
And not all vulnerabilities that are in those databases are going to have a
known fix or a known exploit for them.
Those are going to be zero day vulnerabilities. And the easiest way to describe
what a zero day is is a flaw or a vulnerability in an application or.
A system that has not yet been identified. There's no known patch for it. There
's no known exploit for it. It's it exists.
But there are the folks that are in charge of patching those types of software
and other platforms have not yet developed something to prevent that security
flaw.
And zero days are reported and I'm going to show you one of those actual
databases. What we're taking a look at here is zero dash day dot C, and I have
a link for below.
This is generally what I use or you can Google and try to find one that fits
your needs even better.
But this is just a centralized reporting of a zero day of vulnerabilities that
are known that their exploit or security patch is not known.
And as I zoom in, you'll see that some of these actually relate to a CVE.
Some of them do. There are going to be some in here that you find that don't
and that's okay.
So what this means is that there is a been a notice of a vulnerability that has
been identified, but no known solution for that vulnerability just yet.
And if there's a CVE number attached to these and you update your scanners
definitions database, then there's a big chance that if this exists within that
network, it will pop up on one of your scans.
And that you know that if it's a zero day, you have a likelihood of being able
to exploit that with no known solution for that particular vulnerability.
We're going to take a look at the remote code execution in trip in trend micro
apex one management console.
And you could see here that this one does have a CVE correlating to it.
CVE 2025 4948.
And it's a remote code execution.
Now you can see the description, it shows that what what the vulnerability
allows and the external link to where this there's more information about this.
But what you won't find in here is an actual solution for those security
technicians to be able to go and batch this to prevent folks like us from doing
it.
But there's something to keep in mind about those zero day vulnerabilities.
And that is that not all zero days are going to apply to the pen test scope
that we are partaking in.
Just like that apex apex software that we were just taking a look at, that may
not even exist within the organization that we're conducting our pen test
against.
And that's okay.
But what this does is it provides us with a firm understanding that if we do
run across one of those zero days, there's likelihood that it has been reported
in a database like this or one very similar to it to where you can go through
and gain as much information about that as possible.
As we continue throughout this course, you want to see that there are different
ways to be able to manipulate vulnerabilities.
And it's no different than with those zero day vulnerabilities as well.
Now, I mentioned while ago that we talked about updating our definitions inside
of our scanners, which is something covered in those skills covering scanners.
But it's also important to remember that a zero day may not necessarily pop up
in one of those scan results being a true zero day vulnerability.
You may find it that you can have a method of exploiting a known operating
system or piece of software or network device that you're able to do that
nobody else has figured out yet.
That's the whole thing behind zero days, right?
And this is the way that documentation comes into play and is very important
because not only would you let the organization that your pen testing know that
such a zero day vulnerability exists, but you can also report to places like C
VE and also the zero day database.
Get credit.
Be the one who found that zero day vulnerability and caused all sorts of chaos
with the different organizations out there.
But that allows us other pen testers to be able to learn from things that you
did, things that I did, things that went well that didn't go well.
But more importantly, people will know your name as a qualified pen tester if
you're able to find those zero day vulnerabilities and have a and even better
have a method to exploit them.