Vulnerability › Module 7 › Lesson 2
Verify Safely
Confirm or reject findings on YOUR $LAB_ASSETS — version checks and banners, no exploit PoCs.
Visual · t18_verify_safely
Lab: safe verification on owned hosts only. Original Cyberlium.
Opening
Verify with ssh and package queries — not with exploit modules aimed at someone else's server.
Safe verification on $LAB_ASSETS you own: read installed package version (dpkg -l, rpm -q), check listening port with local netstat/ss, review config file cited by plugin, compare to vendor advisory fixed version. For web findings, curl -I headers on YOUR lab URL only — no injection payloads on stranger sites. Mark finding Confirmed, False Positive, or Needs Patch with one evidence line each. chmod 600 notes under $HOME/cyberlium-lab. NEVER use exploit PoCs, Metasploit confirm modules, or credential brute force on unauthorized targets to 'verify' scanner rows.
1. Safe checks
Package manager version vs advisory — primary FP killer on lab Linux VMs.
Service banner and config path read — document command output redacted.
Command guide
Try these commands — Safe checks
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Optional command
False positives — https://docs.tenable.com/ (scanner tuning literacy)
Greenbone triage — https://docs.greenbone.net/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3 sudo apt install jq
macOS:
Command — copy this
brew install python3 brew install jq
Windows: Download https://python.org/downloads/
Command — copy this
choco install jq
═══ LINUX / macOS ═══
Command — copy this
python3 -c "print('Verify on lab: version match, config context, compensating controls')"
curl -sS 'https://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=1' | jq '.format'Primary tools to practice this lesson: python3, jq. Reference sites: False positives (https://docs.tenable.com/); Greenbone triage (https://docs.greenbone.net/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Status labels
Confirmed: version vulnerable and exposed per RoE threat path.
False Positive: version patched or service not present. Needs Patch: confirmed, fix pending.
3. Hard refusal
No exploit PoCs on any host outside $LAB_ASSETS inventory.
No 'quick nmap' on classmate IP because plugin said so — stay in RoE.
4. What you ship: verification table
Five findings with status + evidence command/output summary — chmod 600.
5. What you record before the next lesson
Verify safely table path.
6. Wrong vs right: stranger nets vs YOUR lab assets
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Run exploit module against café POS system to confirm Critical plugin.
Right
Safe verification on $LAB_ASSETS. Next: risk priority.
Mission: verify five findings
1) Pick five scan rows from $LAB_ASSETS. 2) Safe-check each; assign status. 3) Write NEVER exploit PoC verification.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “When banner check enough vs patch test?”
Knowledge Check
APPLY: Safe verification includes:
Multiple choice
Knowledge Check
APPLY: True or False: Metasploit confirm on unauthorized host is VA lab.
True or False
Knowledge Check
APPLY: Status False Positive needs:
Multiple choice