Vulnerability › Module 4 › Lesson 4
Scanner Lab
Scanner plan pack on $LAB_HOST — role, auth modes, Nessus/OpenVAS job fields; optional lab scan.
Visual · scanner_lab
Lab: scanner plan pack. $LAB_HOST only. Original Cyberlium.
Opening
Plan the job, import scope, optional scan $LAB_HOST — never import dorm /24.
Module 4 lessons covered scanner role, authenticated vs unauthenticated modes, and Nessus/OpenVAS concepts. This lab ships a scanner job plan: scope import=$LAB_HOST, policy choice, auth mode, report path — optional single scan if lab appliance and brief allow. Forbidden: targets outside scope list, aggressive defaults on strangers, sharing raw reports with classmate IPs visible. Next: Quiz — Scanner Literacy.
1. Lab contract: scope CSV first
Verify scope list contains only $LAB_HOST. Merge lessons 4-1 through 4-3 into scanner job plan file.
Optional: run scan against $LAB_HOST on lab Nessus/OpenVAS — save report under $HOME/cyberlium-lab/reports/ chmod 600.
Command guide
Try these commands — Lab contract: scope CSV first
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
OpenVAS substitute — nmap --script vuln on $LAB_HOST only Nmap scripting — https://nmap.org/book/nse.html
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install nmap
macOS:
Command — copy this
brew install nmap
Windows:
Command — copy this
choco install nmap # or download https://nmap.org/download.html
═══ LINUX / macOS ═══
Command — copy this
source "$HOME/cyberlium-lab/t18-lab.env" nmap -sV --script vuln --script-args unsafe=0 "$LAB_HOST" 2>/dev/null | tee "$HOME/cyberlium-lab/t18-vuln-scan.txt" | head -40 grep -i vuln "$HOME/cyberlium-lab/t18-vuln-scan.txt" 2>/dev/null | head -10 || echo 'Review scan output for findings'
Primary tools to practice this lesson: nmap, grep. Reference sites: OpenVAS substitute; Nmap scripting (https://nmap.org/book/nse.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Job fields analysts document
Job name, operator, date, policy, auth mode, cred source (lab vault), target=$LAB_HOST, duration, plugin feed version, output path.
Redact any accidental out-of-scope IP before saving report excerpts.
3. Lock the proof
chmod 600 on plan and reports. Quiz next — then CVE and NVD Literacy.
A well-planned scan on one owned host beats reckless scans on fifty stranger IPs.
4. What you ship: scanner job plan for $LAB_HOST
Merged scanner plan. Optional report on $LAB_HOST only. chmod 600. No stranger targets.
5. What you record before the next lesson
Date. Scanner job plan. Optional scan $LAB_HOST. File t18-m04-l04-scanner-lab.txt chmod 600.
6. Wrong vs right: stranger nets vs YOUR lab assets
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Import dorm /24 targets. Attach full report with neighbor IPs to Discord.
Right
Scanner plan pack on $LAB_HOST. Next: Quiz — Scanner Literacy.
Mission: scanner job evidence pack
1) Verify scope = $LAB_HOST only. 2) Merge role, auth, platform sections into job plan. 3) Optional scan + redacted excerpt. 4) chmod 600. Never scan out-of-scope.
Stuck? Ask Cyberlium AI Mentor
Report excerpt for lab credit: one finding row + CVE link — no exploit steps.
Knowledge Check
APPLY: Scanner Lab target field contains:
Multiple choice
Knowledge Check
APPLY: True or False: Scanner reports should be stored chmod 600 in lab notes.
True or False
Knowledge Check
APPLY: Pirated Nessus plugins on stranger scans:
Multiple choice