Vulnerability › Module 4 › Lesson 1
Scanner Role
Scanners automate checks on scope — findings feed triage, not stranger exploitation on $LAB_HOST.
Visual · scanner_role
Scanner role literacy. $LAB_HOST only. Original Cyberlium.
Opening
A scanner is an analyst's batch question — not permission to hammer every IP on Earth.
Vulnerability scanners (Nessus, OpenVAS, vendor cloud scanners) run plugin libraries against in-scope assets: missing patches, weak ciphers, default creds, known CVE signatures. They produce reports for triage — analysts verify, prioritize, and assign owners. Cyberlium teaches scanner role vocabulary on $LAB_HOST planning — credentialed vs unauthenticated profiles come next. You will NOT point scanners at café Wi-Fi, employer prod without ticket, or internet ranges because plugins exist. Next: Authenticated vs Unauth.
1. What scanners automate
Plugins check version banners, config files (when credentialed), and registry keys against vulnerability signatures. Output: severity, plugin ID, CVE references, remediation text — raw material for triage.
On $LAB_HOST, plan which profile fits: lab VM with your SSH creds vs external unauthenticated web check — both stay on scope list only.
Command guide
Try these commands — What scanners automate
═══ LINUX / KALI (Penetration Testing & Service Audit) ═══
Port scan and service banner grabbing against authorized target
Command — copy this
nmap -sV -sC -Pn -T4 -p 21,22,80,443,445,3389 ${LAB_HOST:-127.0.0.1}Enumerate web directories and hidden endpoints
Command — copy this
gobuster dir -u http://${LAB_HOST:-127.0.0.1} -w /usr/share/wordlists/dirb/common.txt -q -t 20 2>/dev/null || head -5 /etc/hostsMetasploit framework module inspection (Safe lab syntax)
Command — copy this
msfconsole -q -x "use auxiliary/scanner/portscan/tcp; set RHOSTS 127.0.0.1; set PORTS 80,443; run; exit" 2>/dev/null || echo "Run in Kali msfconsole"
═══ WINDOWS (Audit Target) ═══ Enumerate open listening ports with process mappings
Command — copy this
netstat -ano | findstr /i "LISTENING"
Primary tools to practice this lesson: curl, nmap. Reference sites: Greenbone OpenVAS (https://www.greenbone.net/en/openvas/); Nmap NSE (https://nmap.org/book/nse.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Scanners complement, not replace, analysts
False positives, missed logic flaws, and context gaps require human review. Scanners do not authorize themselves — RoE and scope list do.
Running aggressive scanner defaults on stranger networks creates outages and legal risk — not VA homework.
3. Lab planning without stranger targets
Document scanner job fields: name, scope=$LAB_HOST, profile type TBD, schedule=manual lab, output path under $HOME/cyberlium-lab chmod 600.
Ship: scanner role paragraph for $LAB_HOST. Next: Authenticated vs Unauth.
4. What you ship: scanner role note for $LAB_HOST
Document scanner purpose, inputs (scope), outputs (findings). $LAB_HOST only. chmod 600.
5. What you record before the next lesson
Date. Scanner role paragraph. Scope=$LAB_HOST. File t18-m04-l01-scanner-role.txt chmod 600.
6. Wrong vs right: stranger nets vs YOUR lab assets
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Launch Nessus on dorm /24. Treat scanner CRITICAL as auto-exploit ticket on strangers.
Right
Write scanner role for $LAB_HOST scope. Next: Authenticated vs Unauth.
Mission: define scanner role on scope
1) Write what scanners automate vs what analysts verify. 2) List three scanner output fields (severity, CVE, plugin). 3) Tie job to $LAB_HOST scope only. Never aim scanners at out-of-scope IPs.
Stuck? Ask Cyberlium AI Mentor
Scanners are loud — scope keeps the noise on assets you own.
Knowledge Check
APPLY: VA scanners primarily produce:
Multiple choice
Knowledge Check
APPLY: True or False: Scanner CRITICAL findings require human verification.
True or False
Knowledge Check
APPLY: Nessus on café Wi-Fi:
Multiple choice