Scan one host twice and diff what credentials reveal

short · 50 min · Objective 3.1

Task

Scan a single lab host both unauthenticated and authenticated, then account for every difference — because unauthenticated shows what an outsider sees and authenticated shows what is actually there, and the diff is what you are paid to explain.

Steps

  1. On the lab network you own, build a target and deliberately leave something wrong on it: an outdated package, a weak file permission, a poorly configured service.
  2. Create a least-privilege scan account on it — read access to what the scan reads, dedicated to scanning, nothing more.
  3. From the attacker VM, run an unauthenticated scan and save to /tmp/unauth.txt.
  4. Run an authenticated scan with the scan account and save to /tmp/auth.txt.
  5. Diff them and account for every difference: issues that appear only with credentials, and any unauthenticated finding that authentication disproves — the backported-patch false positive appearing in front of you.
  6. Write two sentences describing the host's posture, one from each scan, and notice how different they are.

Verify

wc -l < /tmp/unauth.txt
wc -l < /tmp/auth.txt
comm -13 <(sort -u /tmp/unauth.txt) <(sort -u /tmp/auth.txt) | wc -l

The authenticated scan should report more than the unauthenticated one — more findings is the correct result, not a broken scan. The third command counts what the authenticated scan found that the unauthenticated one did not, and it must be non-zero: those are the local issues invisible from outside, which are most of what a host actually has wrong with it.

Notes

Failed credentials usually degrade silently to an unauthenticated scan — fewer findings, which reads as better and is not — so a real engagement confirms authentication independently, in the target's own logs or with a canary finding only a credentialed check can see. Careless issuance of a scan account, like a domain admin emailed in plaintext, is itself a finding. Everything here ran on a host you built.

This is an independent study companion for CompTIA PenTest+ PT0-003 and is not produced by or endorsed by CompTIA.