Vulnerability Assessment without Vulnerability Scanner