Triage Lab
Full triage pass on YOUR $LAB_ASSETS scan — verify, prioritize, dedupe, document.
Visual · t18_triage_lab
Lab: triage workflow on $LAB_ASSETS export. Original Cyberlium.
One clean triage spreadsheet from your lab scan beats ten hot takes about stranger CVEs.
On YOUR $LAB_ASSETS scan export: (1) dedupe plugin rows; (2) verify safely at least eight findings — mix of Confirmed, FP, Needs Patch; (3) assign P1/P2/P3 to confirmed; (4) write executive summary counts (confirmed vs FP vs open). Store triage workbook chmod 600 in $HOME/cyberlium-lab. No exploit PoCs, no scanning new unauthorized hosts to pad row count, no sharing raw classmate scan files. This pack feeds VA reporting module.
1. Dedupe and verify
Collapse duplicate CVE/plugin on same host. Safe-check per verify lesson.
Evidence column: command or config path — redact secrets.
Command guide
Try these commands — Dedupe and verify
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
VA verification — run follow-up scan on $LAB_HOST after triage Nmap — https://nmap.org/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install nmap
macOS:
Command — copy this
brew install nmap
Windows:
Command — copy this
choco install nmap # or download https://nmap.org/download.html
═══ LINUX / macOS ═══
Command — copy this
source "$HOME/cyberlium-lab/t18-lab.env" nmap -sV --top-ports 5 "$LAB_HOST" grep priority "$HOME/cyberlium-lab/t18-triage.txt" 2>/dev/null || echo 'Fill triage.txt after scan review'
Primary tools to practice this lesson: grep, nmap. Reference sites: VA verification; Nmap (https://nmap.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Priority pass
P1/P2/P3 on confirmed only. Note environmental adjustments from Module 6.
Executive summary: X confirmed, Y FP, Z open by priority tier.
3. Teardown
chmod 600 workbook. No public gist with live lab IPs.
Handoff note for reporting module: top three P1 titles only.
4. What you ship: triage lab workbook
Deduped table + eight verified rows + priority summary — chmod 600.
5. What you record before the next lesson
Triage lab workbook path.
6. Wrong vs right: stranger nets vs YOUR lab assets
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Add findings from unauthorized internet scan to look thorough.
- Right: Triage complete on $LAB_ASSETS. Next: quiz.
Mission: triage lab
1) Dedupe YOUR export. 2) Verify eight findings safely. 3) Priority summary; secure workbook.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Minimum evidence for FP closure?”
APPLY: Triage lab scope:
APPLY: True or False: Exploit PoCs required for triage.
APPLY: Triage output includes: