Run vulnerability discovery end to end and defend every finding

capstone · 150 min · Objective 3.3

Task

Run the whole of Domain 3 against your own lab: scan with multiple tools authenticated and unauthenticated, validate every candidate, triage to a defensible list, and produce findings you could each survive a challenge on. This is vulnerability discovery and analysis unguided, and its rule is that the scanner narrows where to look and you decide what is true.

Steps

  1. On the lab you own, build three hosts with a known mix of issues — a signature-detectable one, a backported false positive, and a logic flaw — writing the ground truth down first.
  2. Scan with two scanners, unauthenticated then authenticated, into /tmp/disc/, saving policies and coverage metadata.
  3. Read the scan metadata first: authentication status, hosts targeted vs completed, feed version. Catch any silent failure before reading findings.
  4. Validate each candidate independently on the lab host; disprove the backported false positive; confirm neither scanner found the logic flaw.
  5. Triage to /tmp/disc/validated.md — findings you can each reproduce, with severity (base, adjustment, reason) and impact — and /tmp/disc/dropped.md with a reason each.
  6. Confirm your validated list is short, defensible, and includes the logic flaw you found by hand and no scanner did.

Verify

ls /tmp/disc/ | grep -cE "\.(md|txt)$"
grep -cE "^finding:" /tmp/disc/validated.md
grep -cE "^severity:.*(because|reason)" /tmp/disc/validated.md
grep -ciE "logic|business rule|found by hand" /tmp/disc/validated.md
grep -cE "^drop:" /tmp/disc/dropped.md

The first count must be at least 4 — the pipeline produced its artifacts. The second and third must be equal and non-zero: every finding has a reasoned severity. The fourth must be non-zero: the logic flaw a human found and no scanner did is in the list. The fifth must be non-zero: dropped items carry reasons. That whole set is Domain 3's argument in one deliverable.

Notes

The scanner produces a list; the tester produces an assessment, and the distance between them is the value of the engagement. Reading scan metadata before findings is what catches the credential silently degrading to unauthenticated — fewer findings that read as better and are not. One disproved finding puts the whole report in question, which is why fewer demonstrated findings beat more inferred ones. Everything ran on hosts you built.

This is an independent study companion for CompTIA PenTest+ PT0-003 and is not produced by or endorsed by CompTIA.