Build a merged, deduplicated finding pipeline

applied · 85 min · Objective 3.3

Task

Take structured exports from two scanners plus your own manual findings and merge them into one deduplicated pipeline that carries coverage metadata through to the report — because two tools name the same issue differently, and a scanner description pasted straight in is generic by construction. Objective 3.3 covers the discovery tools.

Steps

  1. From the lab you own, gather two scanner exports (/tmp/a.txt, /tmp/b.txt) and a short list of your own manually confirmed findings (/tmp/manual.txt).
  2. Write a merge script that deduplicates on the underlying issue — host plus the real vulnerability — rather than on each tool's own identifier.
  3. For each merged finding, replace the scanner's generic description with an impact statement for this environment.
  4. Carry coverage through: hosts targeted, hosts completed, feed version, authentication status — the metadata that decides what the findings mean.
  5. Output /tmp/pipeline.md, one entry per distinct finding with its sources and impact, and a coverage header.
  6. Confirm the merged count is lower than the naive sum, because the tools overlapped.

Verify

grep -cE "^finding:" /tmp/pipeline.md
grep -ciE "^coverage:|targeted|completed|feed" /tmp/pipeline.md
awk 'END{print NR" raw lines in"}' /tmp/a.txt /tmp/b.txt

The first count is the distinct findings after dedup — it must be non-zero and, against the raw line total from the last command, clearly smaller, proving the overlap was removed. The second must be non-zero: the pipeline carries coverage metadata, so a reader knows what was and was not looked at. The impact rewrites are checked by reading — the commands confirm the structure that makes them possible.

Notes

Deduplicate on the issue, not the tool's identifier, because the two scanners name things differently. Never paste a scanner's description straight into the report — lesson 6 requires impact stated for this client. Licence limits and free-feed lag become limitations of your assessment, and a limitation you did not disclose is one the client assumes was not there. Every input here came from a host you built.

This is an independent study companion for CompTIA PenTest+ PT0-003 and is not produced by or endorsed by CompTIA.