Disprove a scanner finding before it reaches a report

short · 50 min · Objective 3.2

Task

Take a scanner finding on a lab host and confirm or disprove it by a second, independent method — specifically the backported-patch false positive, where a version banner says vulnerable and the software is not. Nothing goes in a report that you have not reproduced.

Steps

  1. On the lab network you own, install a package whose banner shows an old version but which carries a backported security fix — the version string stays, the fix landed.
  2. Run an unauthenticated scan and confirm it reports the version's known issue as a finding.
  3. Now confirm the truth independently: authenticate and read the actual package version and its distribution revision, where the backport shows.
  4. Record the finding as disproved, with the evidence: banner version, actual patched revision, and the reasoning.
  5. Do the reverse too: confirm that a current version string does not prove patched if the running process started before the update landed.

Verify

grep -ciE "CVE|vulnerable|outdated" /tmp/scan.txt
grep -ciE "backport|patched|revision|disproved" /tmp/validation.md
grep -ciE "banner|actual version|process.*restart" /tmp/validation.md

The first count must be non-zero: the scan produced the version-based finding. The second must be non-zero: your validation disproves it with the backport evidence. The third must be non-zero: you recorded both the banner and the actual version, and noted the reverse case — a patched file with an unrestarted process is a real finding scanners miss.

Notes

One finding disproved in a meeting does not just remove that finding — it puts every other finding in the report in question, and you will not get to defend each one. So confirm exploitability by observing the condition or by exploiting a replica in your own lab, never by exploiting production because it was quicker. A real finding can carry reduced severity for stated reasons; record the reasoning rather than deleting the finding. Everything here ran on a host you built.

This is an independent study companion for CompTIA PenTest+ PT0-003 and is not produced by or endorsed by CompTIA.