Authenticated vs Unauth
Credentialed scans see more — both modes stay on $LAB_HOST with lab creds you own.
Visual · authenticated_vs_unauth
Auth vs unauth scan literacy. $LAB_HOST only. Original Cyberlium.
Unauthenticated scans see the outside; authenticated scans read the inside — only on hosts you administer.
Unauthenticated scanning probes services as an external actor would: port 443 TLS issues, banner CVEs, web headers. Authenticated scanning logs into $LAB_HOST with SSH/WMI/SMB creds you control to read patch level, installed packages, and config files — deeper coverage, higher trust requirement. Cyberlium teaches when each applies on YOUR lab VM — never storing classmate passwords or scanning with stolen creds. You will NOT credential-scan employer AD without ticket or use default vendor passwords on café gear. Next: Nessus/OpenVAS Named.
1. Unauthenticated: outsider view
Maps external attack surface: open ports, cert problems, missing headers, version banners matching CVE plugins. Limited visibility into patch state behind auth.
Lab: unauth profile against $LAB_HOST web or SSH banner — scope checked, notes only if brief allows.
Command guide
Try these commands — Unauthenticated: outsider view
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Tenable credentialed scans — https://docs.tenable.com/ OpenVAS auth scan — https://docs.greenbone.net/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install nmap
macOS:
Command — copy this
brew install nmap
Windows:
Command — copy this
choco install nmap # or download https://nmap.org/download.html
═══ LINUX / macOS ═══
Command — copy this
source "$HOME/cyberlium-lab/t18-lab.env" nmap -sV --top-ports 10 "$LAB_HOST" nmap -sV -sC --top-ports 5 "$LAB_HOST"
═══ WINDOWS ═══
Command — copy this
nmap -sV --top-ports 10 127.0.0.1
Primary tools to practice this lesson: nmap. Reference sites: Tenable credentialed scans (https://docs.tenable.com/); OpenVAS auth scan (https://docs.greenbone.net/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Authenticated: insider patch truth
With your lab SSH key or local admin on $LAB_HOST VM, scanners query OS package lists and KB articles — fewer false 'maybe patched' guesses.
Cred storage belongs in scanner vault encrypted — lab uses disposable creds on disposable VM, never classmate or production domain passwords.
3. Choose per scope and RoE
Many cycles run both: unauth for exposure, auth for patch truth — same $LAB_HOST row, same scope file.
Ship: which mode you would run first on $LAB_HOST and why. Next: Nessus/OpenVAS Named.
4. What you ship: auth vs unauth plan for $LAB_HOST
Document unauth + auth use cases on YOUR lab creds. No stranger creds. chmod 600.
5. What you record before the next lesson
Date. Auth/unauth plan for $LAB_HOST. File t18-m04-l02-authenticated-vs-unauth.txt chmod 600.
6. Wrong vs right: stranger nets vs YOUR lab assets
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Use classmate SSH key 'they shared once.' Unauth-only scan then declare patch compliance.
- Right: Plan auth and unauth on $LAB_HOST lab creds. Next: Nessus/OpenVAS Named.
Mission: auth vs unauth planning
1) List three things unauth scans see on $LAB_HOST. 2) List three things auth scans add. 3) Note creds are YOUR lab disposable only. Never use stranger or stolen credentials.
Stuck? Ask Cyberlium AI Mentor
Auth scans need vault hygiene — lab creds rotate with VM snapshots.
APPLY: Authenticated scanning on Cyberlium uses:
APPLY: True or False: Unauthenticated scans alone prove full patch compliance.
APPLY: Storing scanner creds for VA:
Nessus/OpenVAS Named
Part of Vulnerability Assessment — Scanner Literacy.
Scanner Lab
Part of Vulnerability Assessment — Scanner Literacy.
Quiz — Scanner Literacy
Part of Vulnerability Assessment — Scanner Literacy.