Show a false negative appearing between two scans

short · 40 min · Objective 4.3

Task

Scan the same host with and without credentials and compare the findings. The difference is not a preference — it is a set of vulnerabilities the unauthenticated scan reported as absent, which is the dangerous outcome.

Steps

  1. On the target VM, install a package with a known outdated version — or simply record the exact versions of several installed packages, which is what a credentialed scan would read.
  2. Run an unauthenticated scan from the other VM you built: service and version detection only, nmap -sV 10.99.0.20 -oN /tmp/unauth.txt. Record what it could determine.
  3. Now gather what a credentialed scan would see, from the host itself: the full installed package list with versions, the kernel version, and the configuration of the services.
  4. Compare. Count how many installed packages the unauthenticated scan could not see at all, because they do not listen on a port.
  5. Pick one package that is outdated and note that the unauthenticated scan reported nothing about it — a true vulnerability, reported as absent.
  6. Write /tmp/scanning.md with both counts and a sentence on when an unauthenticated scan is nonetheless the right tool.

Verify

grep -c "open" /tmp/unauth.txt
dpkg -l 2>/dev/null | grep -c '^ii' || rpm -qa | wc -l
python3 - <<'PY'
import subprocess
un=len([l for l in open('/tmp/unauth.txt') if '/tcp' in l and 'open' in l])
pkgs=subprocess.run("dpkg -l 2>/dev/null | grep -c '^ii' || rpm -qa | wc -l",
                    shell=True,capture_output=True,text=True).stdout.strip()
print('services visible unauthenticated: %s | packages installed: %s' % (un,pkgs))
assert int(pkgs)>un*5, 'expected far more installed packages than visible services'
print('the unauthenticated view covers a small fraction of the attack surface')
PY
grep -ciE "false negative|credential|exposure" /tmp/scanning.md

The assertion makes the scale concrete: there are typically hundreds of installed packages and a handful of listening services, so an unauthenticated scan is blind to almost everything that can be vulnerable. Every one of those is a potential false negative — reported as absent, present in reality.

Notes

The sentence about when unauthenticated scanning is still right matters. It answers a different question: what an external attacker can see without credentials. Both are useful, and treating the unauthenticated result as coverage is the mistake.

This is an independent study companion for CompTIA Security+ SY0-701 and is not produced by or endorsed by CompTIA.