Run two scanners on one host and diff their answers

short · 55 min · Objective 3.3

Task

Scan one lab host with two general-purpose scanners and diff their results into four categories — found by both, by one only, disagreeing on severity, and found by neither. Two independent implementations agreeing is corroboration; one tool's silence is not evidence.

Steps

  1. On the lab you own, take a target with a couple of known issues you planted, so you have ground truth.
  2. Scan it with the first scanner (Nessus-style), configured to avoid any dangerous or denial-of-service checks, and export structured to /tmp/a.txt.
  3. Scan it with the second (OpenVAS-style), configured equivalently, export to /tmp/b.txt.
  4. Diff into four buckets: found by both, by one only, different severities for the same issue, and found by neither but you know it is there.
  5. Save the policy with the results — a finding is only reproducible if the scan can be re-run.
  6. Note where the two disagree on severity, which is a thing to have seen before a client asks why.

Verify

comm -12 <(sort -u /tmp/a.txt) <(sort -u /tmp/b.txt) | wc -l
comm -3 <(sort -u /tmp/a.txt) <(sort -u /tmp/b.txt) | wc -l
grep -ciE "both|one only|neither|severity" /tmp/diff.md

The first count is issues both scanners found — the corroborated, highest- confidence set. The second is issues only one found, and it must be non-zero: that is the concrete demonstration that one scanner's silence is not evidence. The third confirms you wrote up all four categories, including the most valuable one — found by neither, which is the shape of everything a scan misses.

Notes

Select plugin families deliberately; dangerous checks stay off unless the scope names them in writing. The tool's severity is an input, not the answer — it knows the vulnerability and nothing about this client — so the report carries the base score, your adjustment, and the reason. Export structured, keep the raw output, and carry coverage metadata into the report. Both scans ran against a host you built.

This is an independent study companion for CompTIA PenTest+ PT0-003 and is not produced by or endorsed by CompTIA.