Vulnerability › Module 7 › Lesson 1
False Positives
Scanner noise vs real risk — triage YOUR $LAB_ASSETS findings without stranger rescans.
Visual · t18_false_positives
False positive = scanner says vuln; reality says no or not reachable. Original Cyberlium.
Opening
A thousand red rows mean nothing until you sort signal from noise on hosts you are allowed to touch.
Vulnerability scanners produce false positives: wrong version detection, missing context (self-signed cert on lab only), deprecated plugins, or conditions not met in YOUR environment. False negatives also exist — scanner missed issue. Learn FP patterns on $LAB_ASSETS exports: compare plugin output to actual package version, service banner, and config you can read legally. Never 'verify' by aggressive scanning classmate networks or running exploit PoCs on production strangers. Triage is disciplined verification within RoE — next lesson covers safe checks on owned lab assets.
1. Common FP sources
Version fingerprint errors, credentialed vs uncredentialed scan gaps, generic SSL/TLS warnings on dev.
Duplicate plugin IDs counting same flaw twice — dedupe before executive totals.
Command guide
Try these commands — Common FP sources
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
VA triage — https://owasp.org/www-community/Vulnerability_Scanning_Tools NIST CSF — https://www.nist.gov/cyberframework
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install nmap
macOS:
Command — copy this
brew install nmap
Windows:
Command — copy this
choco install nmap # or download https://nmap.org/download.html
═══ LINUX / macOS ═══
Command — copy this
grep -E 'open|vuln' "$HOME/cyberlium-lab/t18-inventory.txt" 2>/dev/null | head -10 || source "$HOME/cyberlium-lab/t18-lab.env"; nmap -sV --top-ports 10 "$LAB_HOST"
python3 -c "print('Triage: true_positive | false_positive | accepted_risk')"Primary tools to practice this lesson: grep, nmap. Reference sites: VA triage (https://owasp.org/www-community/Vulnerability_Scanning_Tools); NIST CSF (https://www.nist.gov/cyberframework). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Triage mindset
Ask: is service actually running? Is version accurate? Is path reachable from threat model scope?
Document FP with evidence line — plugin ID, actual version, why not applicable.
3. Scope boundary
Triage findings from YOUR $LAB_ASSETS scans only.
No mass-rescan of dorm building /24 to 'reduce noise' — that is unauthorized scanning.
4. What you ship: false positive patterns
Three FP pattern examples + dedupe note + NEVER stranger rescan sentence.
5. What you record before the next lesson
False positive notes path.
6. Wrong vs right: stranger nets vs YOUR lab assets
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Active-scan entire university subnet because lab VM had noisy plugins.
Right
Name FP sources. Next: verify safely.
Mission: FP pattern sheet
1) List three FP causes. 2) Write dedupe before reporting rule. 3) Write NEVER unauthorized rescan.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Credentialed scan FP reduction?”
Knowledge Check
APPLY: False positive means:
Multiple choice
Knowledge Check
APPLY: True or False: Rescan stranger networks to triage YOUR export is lab.
True or False
Knowledge Check
APPLY: Before exec totals:
Multiple choice