Vulnerability › Module 2 › Lesson 4
Contrast Lab
VA vs pentest contrast pack on $LAB_HOST — definitions and when-which; literacy file only.
Visual · contrast_lab
Lab: VA vs pentest contrast pack. $LAB_HOST only. Original Cyberlium.
Opening
Three artifacts, one lab host, zero exploit PoCs on strangers.
Lessons 2-1 through 2-3 named VA, contrasted pentest, and when-which criteria. This lab ships combined evidence for $LAB_HOST: VA definition, contrast table, when-which checklist — paperwork only, no scanner or exploit runs required. No Metasploit on classmates. No dorm nmap labeled 'pentest.' Next: Quiz — VA vs Pentest.
1. Lab contract: merge contrast artifacts
Create $HOME/cyberlium-lab/t18-m02-l04-contrast-lab.txt merging lessons 2-1 through 2-3 with date and $LAB_HOST named.
Optional: one sentence on how Topic 18 VA differs from Topic 19 pentest preview.
Command guide
Try these commands — Lab contract: merge contrast artifacts
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
OWASP Testing Guide — https://owasp.org/www-project-web-security-testing-guide/ NVD search — https://nvd.nist.gov/vuln/search
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3 sudo apt install curl
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/ Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
cat > "$HOME/cyberlium-lab/t18-va-vs-pentest.txt" <<'EOF' scenario: quarterly patch review on lab VM choice: VA (inventory + CVE mapping) EOF
Command — copy this
curl -sS https://nvd.nist.gov/vuln/search | head -5
Primary tools to practice this lesson: python3, curl. Reference sites: OWASP Testing Guide (https://owasp.org/www-project-web-security-testing-guide/); NVD search (https://nvd.nist.gov/vuln/search). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Cross-check misuse labels
Grep notes for words like 'pentest' paired with stranger IPs — redact or rewrite to $LAB_HOST planning only.
Classmates document their own lab; do not share exploit targets.
3. Lock the proof
chmod 600. Quiz next — then Asset Inventory.
Analyst teams archive scope decisions with RoE; you practice that habit early.
4. What you ship: VA vs pentest contrast pack for $LAB_HOST
Definition, contrast table, when-which checklist. No stranger exploitation. chmod 600.
5. What you record before the next lesson
Date. Contrast pack complete. $LAB_HOST named. File t18-m02-l04-contrast-lab.txt chmod 600.
6. Wrong vs right: stranger nets vs YOUR lab assets
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Add exploit module output from stranger host. Skip contrast table.
Right
Combined contrast pack on $LAB_HOST. chmod 600. Next: Quiz — VA vs Pentest.
Mission: contrast evidence pack
1) Merge VA definition, contrast table, when-which sections. 2) Name $LAB_HOST. 3) chmod 600. Never include stranger scan or exploit evidence.
Stuck? Ask Cyberlium AI Mentor
Paperwork discipline separates analysts from unauthorized scanners.
Knowledge Check
APPLY: This lab requires:
Multiple choice
Knowledge Check
APPLY: True or False: chmod 600 applies to contrast notes.
True or False
Knowledge Check
APPLY: A tutorial pentests a public shop. You:
Multiple choice