Vulnerability › Module 4 › Lesson 1
Scanner Role
Scanners automate checks on scope — findings feed triage, not stranger exploitation on $LAB_HOST.
Visual · scanner_role
Scanner role literacy. $LAB_HOST only. Original Cyberlium.
Opening
A scanner is an analyst's batch question — not permission to hammer every IP on Earth.
Vulnerability scanners (Nessus, OpenVAS, vendor cloud scanners) run plugin libraries against in-scope assets: missing patches, weak ciphers, default creds, known CVE signatures. They produce reports for triage — analysts verify, prioritize, and assign owners. Cyberlium teaches scanner role vocabulary on $LAB_HOST planning — credentialed vs unauthenticated profiles come next. You will NOT point scanners at café Wi-Fi, employer prod without ticket, or internet ranges because plugins exist. Next: Authenticated vs Unauth.
1. What scanners automate
Plugins check version banners, config files (when credentialed), and registry keys against vulnerability signatures. Output: severity, plugin ID, CVE references, remediation text — raw material for triage.
On $LAB_HOST, plan which profile fits: lab VM with your SSH creds vs external unauthenticated web check — both stay on scope list only.
Command guide
Try these commands — What scanners automate
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Greenbone OpenVAS — https://www.greenbone.net/en/openvas/ Nmap NSE — https://nmap.org/book/nse.html
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl sudo apt install nmap
macOS:
Command — copy this
brew install nmap
Windows: Built-in (PowerShell: Invoke-WebRequest)
Command — copy this
choco install nmap # or download https://nmap.org/download.html
═══ LINUX / macOS ═══
Command — copy this
curl -sS https://www.greenbone.net/en/openvas/ | head -5 source "$HOME/cyberlium-lab/t18-lab.env"; nmap -sV --top-ports 10 "$LAB_HOST"
Primary tools to practice this lesson: curl, nmap. Reference sites: Greenbone OpenVAS (https://www.greenbone.net/en/openvas/); Nmap NSE (https://nmap.org/book/nse.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Scanners complement, not replace, analysts
False positives, missed logic flaws, and context gaps require human review. Scanners do not authorize themselves — RoE and scope list do.
Running aggressive scanner defaults on stranger networks creates outages and legal risk — not VA homework.
3. Lab planning without stranger targets
Document scanner job fields: name, scope=$LAB_HOST, profile type TBD, schedule=manual lab, output path under $HOME/cyberlium-lab chmod 600.
Ship: scanner role paragraph for $LAB_HOST. Next: Authenticated vs Unauth.
4. What you ship: scanner role note for $LAB_HOST
Document scanner purpose, inputs (scope), outputs (findings). $LAB_HOST only. chmod 600.
5. What you record before the next lesson
Date. Scanner role paragraph. Scope=$LAB_HOST. File t18-m04-l01-scanner-role.txt chmod 600.
6. Wrong vs right: stranger nets vs YOUR lab assets
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Launch Nessus on dorm /24. Treat scanner CRITICAL as auto-exploit ticket on strangers.
Right
Write scanner role for $LAB_HOST scope. Next: Authenticated vs Unauth.
Mission: define scanner role on scope
1) Write what scanners automate vs what analysts verify. 2) List three scanner output fields (severity, CVE, plugin). 3) Tie job to $LAB_HOST scope only. Never aim scanners at out-of-scope IPs.
Stuck? Ask Cyberlium AI Mentor
Scanners are loud — scope keeps the noise on assets you own.
Knowledge Check
APPLY: VA scanners primarily produce:
Multiple choice
Knowledge Check
APPLY: True or False: Scanner CRITICAL findings require human verification.
True or False
Knowledge Check
APPLY: Nessus on café Wi-Fi:
Multiple choice