Module 05 — Vulnerability Analysis · Guided Lab Walkthrough¶

Scan only your own lab (see ../../labs/topology.md). Each step: command, expected observation, a hint, and the defender/PAM takeaway. Outputs are representative. Pairs with README.md · facts.md.

Goal: run a real vulnerability scan, read CVSS/CVE output, triage by risk, and see why authenticated scanning and the PAM angle matter.

Target: Metasploitable2 192.168.56.20 (intentionally vulnerable — perfect for VA practice).

Part A — Quick web/misconfig scan (fast win)¶

nikto -h http://192.168.56.20               # web server issues

You should see outdated-software and misconfiguration findings (e.g., old Apache/PHP, dangerous HTTP methods, default files). Observe: Nikto is noisy and web-focused — great for a fast first pass, not a full picture.

Part B — Full vulnerability scan (OpenVAS/GVM)¶

# with Greenbone/GVM running:
sudo gvm-start
# create a target 192.168.56.20 and a "Full and fast" scan task in the web UI (https://localhost:9392)

You should see a report listing vulnerabilities with CVSS scores and CVE references, ranked by severity (e.g., a Critical vsftpd 2.3.4 backdoor, Samba RCE).

Hint

No GVM? `nmap --script vuln 192.168.56.20` gives a lighter NSE-based vulnerability pass you can read immediately.

Part C — Triage by risk (not just raw score)¶

From your report, sort findings and ask, for each: - Exposure: is it reachable from where an attacker would sit? - Exploit availability: is there public/weaponized exploit code (Module 06 will use some)? - Asset value: how important is this host?

Finding	CVSS	Exposed?	Exploit?	Priority
vsftpd 2.3.4 backdoor	9.8	yes	yes (Metasploit)	fix first
Old Apache info leak	5.3	yes	low	later

Observe: two "High" CVEs are not equal — context turns a raw score into real risk.

Part D — Authenticated vs unauthenticated (accuracy lesson)¶

Re-run a credentialed scan (provide SSH creds msfadmin/msfadmin to GVM). You should see more findings (missing patches, local config issues) and fewer false positives than the unauthenticated pass.

Defender/PAM view: the scanner's credential is powerful and standing — vault it, rotate it, grant JIT (attack-to-control-matrix.md). And patch the PAM stack itself; it's Tier 0.

What you should conclude¶

Step	Takeaway
Nikto	Fast web-misconfig triage, noisy
GVM full scan	CVSS + CVE ranked findings
Risk triage	Context beats raw CVSS
Authenticated scan	Deeper, fewer false positives

Cleanup¶

Stop GVM if desired (sudo gvm-stop); remove exported reports you don't need.

Record it¶

Log your top-3 prioritized findings (with CVSS/CVE) in the My lab log table in README.md; track weak areas in PROGRESS.md.