Scan the same host four ways and compare the counts

Steps

1. On the Linux VM, install a scanner you can run repeatedly, and deliberately age the target: install a handful of older packages on the Windows VM and skip its updates so there is something real to find.

Normalise every export the same way. Scanners export CSV with their own column names and orders, and quote any field containing a comma -- which awk -F, does not understand. Five later labs read these files by column position, so each export is converted to one fixed shape first:

ip,host,port,vector,score,name

One header row, then one row per finding: vector is the CVSS vector string (fill it from the CVE's NVD entry if your scanner does not export it), score the base score, and name the finding's title LAST, because titles contain commas and a field at the end cannot shift the others. Save this once as /tmp/normalise.py:

import csv, sys
src, out, *pairs = sys.argv[1:]
col = dict(p.split("=", 1) for p in pairs)
with open(src, newline="", encoding="utf-8-sig") as f, open(out, "w", newline="") as g:
    w = csv.writer(g)
    w.writerow(["ip", "host", "port", "vector", "score", "name"])
    for r in csv.DictReader(f):
        head = [(r.get(col[k]) or "").replace(",", ";")
                for k in ("ip", "host", "port", "vector", "score")]
        w.writerow(head + [r.get(col["name"]) or ""])

and run it with your scanner's own column names on the right of each =, for example python3 /tmp/normalise.py export.csv /tmp/scan-cred.csv ip=IP host=Hostname port=Port vector="CVSS Vector" score=CVSS name="NVT Name". Scans one to four below become /tmp/scan-uncred.csv, /tmp/scan-cred.csv, and -- for scan four -- /tmp/scan-badcred.csv. 2. Scan one: uncredentialed, from the Linux VM. Record the finding count by severity. 3. Scan two: credentialed. Supply an account with local administrator rights and repeat. Record the counts. 4. Scan three: host firewall on. Enable the Windows firewall to block inbound, re-run the uncredentialed scan, and record what happens. 5. Scan four: uncredentialed again, but with the credential deliberately wrong. This is the important one -- record whether the scanner told you plainly that authentication failed, or simply returned fewer findings. 6. Build the comparison table and write one sentence on what an unannotated count from any single one of these four would have told a manager.

Files the Verify reads

The Verify block reads these by name, so save them exactly here:

• /tmp/scan-badcred.log -- the scanner's own log or status output for scan four, the one with the wrong credential.