CVE Lab — Vulnerability Assessment

Visual · cve_lab

Lab: CVE/NVD pack. $LAB_HOST only. Original Cyberlium.

One finding, one NVD read, one patch line — zero exploit reels.

Module 5 lessons named CVE, taught NVD reading, and excluded mandatory PoCs. This lab merges artifacts for one $LAB_HOST finding: CVE row, NVD read note, remediation without exploit — under $HOME/cyberlium-lab chmod 600. Optional: link scanner excerpt redacted to $LAB_HOST. Forbidden: exploit steps, stranger targets, PoC attachments. Next: Quiz — CVE and NVD Literacy.

1. Lab contract: one finding, full chain

Pick one finding from $LAB_HOST scanner plan or sample row. Merge CVE name, NVD read, no-PoC remediation into t18-m05-l04-cve-lab.txt.

Include NVD URL and vendor reference — exclude exploit-db PoC links.

Command guide

Try these commands — Lab contract: one finding, full chain

═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)

CVE note template — NVD + FIRST CVSS literacy NVD — https://nvd.nist.gov

═══ INSTALL ═══

Linux (Debian/Ubuntu):

Command — copy this

sudo apt install jq

macOS:

Command — copy this

brew install jq

Windows:

Command — copy this

choco install jq

═══ LINUX / macOS ═══

Command — copy this

curl -sS 'https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2021-44228' | jq '.vulnerabilities[0].cve.id' > "$HOME/cyberlium-lab/t18-cve-note.txt"
cat >> "$HOME/cyberlium-lab/t18-cve-note.txt" <<'EOF'
impact: (from NVD summary)
patch_or_compensate:
owner: lab admin
EOF

Command — copy this

grep -E 'CVE|impact|owner' "$HOME/cyberlium-lab/t18-cve-note.txt"

Primary tools to practice this lesson: jq, grep. Reference sites: CVE note template; NVD (https://nvd.nist.gov). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Applicability and owner

State applicable Y/N on $LAB_HOST with reason (version match or false positive). Owner = you (lab). Planned fix date = next snapshot window.

Redact any neighbor IP from scanner excerpts before save.

3. Lock the proof

chmod 600. Quiz next — then CVSS Scoring (Module 6).

Analyst packs with vendor KB citations beat exploit videos on strangers.

4. What you ship: CVE/NVD pack for one $LAB_HOST finding

CVE row, NVD read, remediation no-PoC. Vendor ref included. chmod 600.

5. What you record before the next lesson

Date. CVE pack on $LAB_HOST. File t18-m05-l04-cve-lab.txt chmod 600.

6. Wrong vs right: stranger nets vs YOUR lab assets

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong: Attach Metasploit output from stranger host. Skip NVD URL.
Right: CVE/NVD pack on $LAB_HOST. Next: Quiz — CVE and NVD Literacy.

Hands-on Exercise

Mission: CVE evidence pack

1) One $LAB_HOST finding with CVE-ID. 2) NVD read note with vendor reference. 3) Remediation + 'PoC not required.' 4) chmod 600. Never include exploit steps.

Pro Tip

Stuck? Ask Cyberlium AI Mentor

Module 6 adds CVSS depth — this lab cites base score from NVD only.

Practice QuizQuestion 1

Multiple choice

APPLY: CVE Lab requires:

Practice QuizQuestion 2

True or False

APPLY: True or False: Vendor advisory links belong in CVE lab notes.

Practice QuizQuestion 3

Multiple choice

APPLY: Exploit PoC against classmate VM to 'complete CVE lab':