Break a scan on purpose and catch the silent failure

short · 50 min · Objective 3.2

Task

Make a scan of your lab fail in the two ways that produce a plausible, complete-looking, badly incomplete result — a firewall dropping probes, and credentials silently degrading to unauthenticated — then catch each by reading the scan's own metadata rather than its findings. An empty result means "nothing found" or "nothing looked at", and the scanner rarely separates them.

Steps

  1. On the lab you own, take a target you have scanned cleanly before, so you know the correct result.
  2. Firewall failure: add a host firewall that drops the scanner's probes, run the scan, and observe the uniform, everything-filtered result that looks like a clean host.
  3. Credential failure: deliberately use a wrong or expired scan account, run the authenticated scan, and observe it quietly produce a smaller, plausible unauthenticated result.
  4. Catch each by evidence, not by the finding count: the target's own auth logs for the failed login, and a canary finding only a credentialed check can see.
  5. Compare hosts targeted with hosts reported on, and read the scan's own log for authentication status and errors.

Verify

grep -ciE "auth|login|credential" /tmp/target-authlog.txt
grep -ciE "authenticated: (no|failed)|no local checks|degraded" /tmp/scan-meta.txt
grep -ciE "targeted|completed|feed|error" /tmp/scan-meta.txt

The first count must be non-zero: the target's auth log shows the scan account's failed login — the independent confirmation that authentication did not work. The second must be non-zero: you read the scan's own status and caught the silent degrade. The third must be non-zero: you checked the metadata that says whether the scan even ran and reached its targets.

Notes

Failed credentials degrading to unauthenticated is the most expensive misconfiguration in this domain, because fewer findings reads as better and is exactly backwards. A clean result on a device class the scanner has no checks for is the purest false assurance — record the feed version and coverage. Read the scanner's log before believing its output: ask the instrument what it did before believing what it says. Everything here ran on a host you built.

This is an independent study companion for CompTIA PenTest+ PT0-003 and is not produced by or endorsed by CompTIA.