Prove one finding false and one finding real

short · 50 min · Objective 2.2

Task

Take two findings from your own scan and settle each by going to the host -- one that is real, one that is not. The skill is not spotting which is which; it is producing the evidence that ends the argument.

Steps

  1. Open your credentialed scan output. Pick two findings: one high-severity that looks plausible, and one you suspect is version-inference only.
  2. For each, write down what the scanner actually observed -- the plugin, the evidence string, the port, the version it inferred.
  3. Go to the host and establish the truth directly: the installed package version, whether the service is running, whether it is listening where the scanner thinks, and whether the distribution backported a fix without changing the version string.
  4. Write the disposition for each with its evidence attached: confirmed, false positive, or unresolved.
  5. Now produce a false negative deliberately. Install something vulnerable that your scanner has no plugin for -- an old binary you compiled yourself into /opt -- and re-scan. Confirm it reports nothing.
  6. Write one sentence for each of the three outcomes explaining what a remediation report built only on scanner output would have said.

Verify

dpkg -l | awk '$2=="openssl"{print $3}'
systemctl is-active ssh
ss -tlnp | grep -c ":22"
ls -l /opt/old-binary && /opt/old-binary --version
grep -ci "old-binary" /tmp/scan-cred.csv

The package version against the scanner's claim settles the first finding. The last two are the false negative: the binary exists and reports its version, and the scan output does not mention it at all. A finding count from this scan would have been an accurate count of what the scanner knows and a misleading count of what is wrong with the host.

Notes

The backport case is the commonest false positive in real environments and the hardest to argue about, because the scanner is reading the version string correctly and drawing a wrong conclusion. The evidence that ends it is the distribution's changelog, not an opinion.

The false negative is the more important half of this lab and the half nobody runs. Keep the sentence you wrote: it is the caveat every scan report should carry and almost none do.

This is an independent study companion for CompTIA CySA+ CS0-004 and is not produced by or endorsed by CompTIA.