Scan the same host four ways and compare the counts

short · 60 min · Objective 2.1

Task

Scan one machine credentialed, uncredentialed, from inside and from outside its own firewall, and put the four result counts side by side. The differences are the whole lesson, and they are far more convincing measured than described.

Steps

  1. On the Linux VM, install a scanner you can run repeatedly, and deliberately age the target: install a handful of older packages on the Windows VM and skip its updates so there is something real to find.
  2. Scan one: uncredentialed, from the Linux VM. Record the finding count by severity.
  3. Scan two: credentialed. Supply an account with local administrator rights and repeat. Record the counts.
  4. Scan three: host firewall on. Enable the Windows firewall to block inbound, re-run the uncredentialed scan, and record what happens.
  5. Scan four: uncredentialed again, but with the credential deliberately wrong. This is the important one -- record whether the scanner told you plainly that authentication failed, or simply returned fewer findings.
  6. Build the comparison table and write one sentence on what an unannotated count from any single one of these four would have told a manager.

Verify

grep -c "^" /tmp/scan-uncred.csv
grep -c "^" /tmp/scan-cred.csv
grep -ci "authentication" /tmp/scan-badcred.log
grep -c "^" /tmp/scan-badcred.csv

The credentialed count must be substantially higher than the uncredentialed one -- typically several times. The last two are the trap: if the third is zero and the fourth is low, your scanner reported a quiet, clean-looking result for a scan that authenticated to nothing. That result is indistinguishable from good news on a dashboard.

Notes

Write down the ratio between scan one and scan two. It is the number to quote whenever someone proposes running uncredentialed scans to save effort.

Scan four is the finding to remember. "The scan completed and found little" and "the scan could not log in" produce the same shape of report, and only an explicit authentication-success check separates them -- which is why the reading-scanner-output lab starts there.

This is an independent study companion for CompTIA CySA+ CS0-004 and is not produced by or endorsed by CompTIA.