Contrast Lab — Vulnerability Assessment

Visual · contrast_lab

Lab: VA vs pentest contrast pack. $LAB_HOST only. Original Cyberlium.

Three artifacts, one lab host, zero exploit PoCs on strangers.

Lessons 2-1 through 2-3 named VA, contrasted pentest, and when-which criteria. This lab ships combined evidence for $LAB_HOST: VA definition, contrast table, when-which checklist — paperwork only, no scanner or exploit runs required. No Metasploit on classmates. No dorm nmap labeled 'pentest.' Next: Quiz — VA vs Pentest.

1. Lab contract: merge contrast artifacts

Create $HOME/cyberlium-lab/t18-m02-l04-contrast-lab.txt merging lessons 2-1 through 2-3 with date and $LAB_HOST named.

Optional: one sentence on how Topic 18 VA differs from Topic 19 pentest preview.

Command guide

Try these commands — Lab contract: merge contrast artifacts

═══ LINUX / KALI (Penetration Testing & Service Audit) ═══

Port scan and service banner grabbing against authorized target

Command — copy this

nmap -sV -sC -Pn -T4 -p 21,22,80,443,445,3389 ${LAB_HOST:-127.0.0.1}

Enumerate web directories and hidden endpoints

Command — copy this

gobuster dir -u http://${LAB_HOST:-127.0.0.1} -w /usr/share/wordlists/dirb/common.txt -q -t 20 2>/dev/null || head -5 /etc/hosts

Metasploit framework module inspection (Safe lab syntax)

Command — copy this

msfconsole -q -x "use auxiliary/scanner/portscan/tcp; set RHOSTS 127.0.0.1; set PORTS 80,443; run; exit" 2>/dev/null || echo "Run in Kali msfconsole"

═══ WINDOWS (Audit Target) ═══ Enumerate open listening ports with process mappings

Command — copy this

netstat -ano | findstr /i "LISTENING"

Primary tools to practice this lesson: python3, curl. Reference sites: OWASP Testing Guide (https://owasp.org/www-project-web-security-testing-guide/); NVD search (https://nvd.nist.gov/vuln/search). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Cross-check misuse labels

Grep notes for words like 'pentest' paired with stranger IPs — redact or rewrite to $LAB_HOST planning only.

Classmates document their own lab; do not share exploit targets.

3. Lock the proof

chmod 600. Quiz next — then Asset Inventory.

Analyst teams archive scope decisions with RoE; you practice that habit early.

4. What you ship: VA vs pentest contrast pack for $LAB_HOST

Definition, contrast table, when-which checklist. No stranger exploitation. chmod 600.

5. What you record before the next lesson

Date. Contrast pack complete. $LAB_HOST named. File t18-m02-l04-contrast-lab.txt chmod 600.

6. Wrong vs right: stranger nets vs YOUR lab assets

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong: Add exploit module output from stranger host. Skip contrast table.
Right: Combined contrast pack on $LAB_HOST. chmod 600. Next: Quiz — VA vs Pentest.

Hands-on Exercise

Mission: contrast evidence pack

1) Merge VA definition, contrast table, when-which sections. 2) Name $LAB_HOST. 3) chmod 600. Never include stranger scan or exploit evidence.

Pro Tip

Stuck? Ask Cyberlium AI Mentor

Paperwork discipline separates analysts from unauthorized scanners.

Practice QuizQuestion 1

Multiple choice

APPLY: This lab requires:

Practice QuizQuestion 2

True or False

APPLY: True or False: chmod 600 applies to contrast notes.

Practice QuizQuestion 3

Multiple choice

APPLY: A tutorial pentests a public shop. You: