Vulnerability › Module 9 › Lesson 3
Retest
Verify fixes on YOUR $LAB_ASSETS — rescan or safe check, close the loop.
Visual · t18_retest
Retest proves remediation worked — same safe methods as verify. Original Cyberlium.
Opening
Closed without retest is hope — rescan your lab VM, not the coffee shop router.
After patch or compensate on $LAB_ASSETS: retest with same safe methods — package version check, targeted plugin rescan on that host only, or full lab rescan per RoE. Update tracker Status to Closed with retest date and evidence line. FP regression: ensure fix did not break service. Never 'retest' by exploit PoC on unauthorized hosts or by scanning new stranger IPs. Failed retest reopens ticket with new due date.
1. Retest methods
Targeted: rescan single host or run plugin-specific check.
Safe manual: verify package version ≥ fixed version from advisory.
Command guide
Try these commands — Retest methods
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Retest plan — rescan $LAB_HOST after patch Nmap — https://nmap.org/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install nmap
macOS:
Command — copy this
brew install nmap
Windows:
Command — copy this
choco install nmap # or download https://nmap.org/download.html
═══ LINUX / macOS ═══
Command — copy this
source "$HOME/cyberlium-lab/t18-lab.env" nmap -sV -p 22,80,443 "$LAB_HOST" grep retest "$HOME/cyberlium-lab/t18-remediation.txt" 2>/dev/null || printf 'retest_plan: nmap -sV after patch ' >> "$HOME/cyberlium-lab/t18-remediation.txt"
Primary tools to practice this lesson: nmap, grep. Reference sites: Retest plan; Nmap (https://nmap.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Close criteria
Closed: retest shows not vulnerable or compensating control verified.
Document retest UTC timestamp and tool version.
3. Boundary
Retest only hosts in $LAB_ASSETS inventory under RoE.
No exploit PoC 'confirmation' — scanner or version check sufficient for VA.
4. What you ship: retest log
Retest procedure + three closed rows with evidence — chmod 600.
5. What you record before the next lesson
Retest log path.
6. Wrong vs right: stranger nets vs YOUR lab assets
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Run exploit to confirm patch on employer server without scope.
Right
Name retest methods. Next: remediation lab.
Mission: retest procedure
1) Write retest steps for patched lab VM. 2) Define Closed criteria. 3) Write NEVER exploit PoC retest.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Full vs targeted rescan?”
Knowledge Check
APPLY: Retest uses:
Multiple choice
Knowledge Check
APPLY: True or False: Closed without retest evidence is OK.
True or False
Knowledge Check
APPLY: Failed retest:
Multiple choice