13.10 Checkpoint: a short list you can defend

The test for this module is not how many vulnerabilities you found. It is whether you can look at several hundred findings and say, with reasons, which four matter.

Run these on UBNT01.

# The scan output from 13.2 exists and has findings in it.
jq '[.Results[].Vulnerabilities[]] | length' ~/nginx-1.20-scan.json

# Both tables loaded, from 13.3. Neither should be 0.
sqlite3 ~/vuln.db "SELECT 'findings: '||COUNT(*) FROM findings;
                   SELECT 'kev: '||COUNT(*) FROM kev;"

# The join that is the point of the module.
sqlite3 -header -column ~/vuln.db \
  "SELECT DISTINCT f.cve, f.package, f.severity, f.fixed_in
   FROM findings f JOIN kev k ON f.cve = k.cve
   ORDER BY f.package;"

# The funnel, in one line.
sqlite3 ~/vuln.db \
  "SELECT COUNT(*)||' findings' FROM findings;
   SELECT COUNT(DISTINCT cve)||' distinct CVEs' FROM findings;
   SELECT COUNT(DISTINCT f.cve)||' in KEV' FROM findings f JOIN kev k ON f.cve=k.cve;"

If you built the network scanner, also:

# Greenbone's containers are running, from 13.4.
cd ~/docker/greenbone && docker compose ps

# Network findings loaded, from 13.5.
sqlite3 -header -column ~/vuln.db \
  "SELECT ip, COUNT(*) AS findings FROM netfindings GROUP BY ip ORDER BY findings DESC;"

Pass criteria

Everyone, any tier:

If you built the network scanner (13.4 to 13.6):

Greenbone's containers run and the web interface answers on https://10.10.10.20:9392 (lesson 13.4)
You can say why the certificate warning appears, and why clicking through it here differs from doing so on the internet (lesson 13.4, building on 7.1)
You wrote your scan scope down before opening the tool, and can say what 10.10.0.0/16 would have done instead (lesson 13.5)
A full scan of 10.10.10.0/24 completed and you exported the report (lesson 13.5)
You can explain why an unauthenticated scan produces version-banner false positives (lesson 13.5)
A dedicated scanning account exists, and you can state its privileges and your reasoning in one sentence (lesson 13.6)
You can explain why giving a scanner Domain Admin is a standard path in real intrusions (lesson 13.6, building on 5.6)
You ran the credentialed scan with your Wazuh dashboard open, and recorded whether the 12.6 exception was as narrow as you intended (lesson 13.6)
You chose one of the three ways to handle the recurring scanner alert and wrote the reasoning next to it in Git (lesson 13.6, building on 12.5)

Tier 2 and up, with the domain:

You ran move-fsmo.ps1 in report mode before patching, not from memory (lesson 13.7, building on 5.10)
You patched one domain controller at a time, checked Get-Service adws,kdc,netlogon,ntds was healthy, and confirmed repadmin /replsummary was clean before touching the second (lesson 13.7, building on 5.9)
You can explain why redundancy fails when maintenance ignores it, and name another pair in your lab it applies to (lesson 13.7)
You know whether a reboot is outstanding on each machine, and why a patched-but-unrebooted kernel produces a false clean scan (lesson 13.7)
You rescanned after patching, and can say why the rescan is the real proof rather than the command's exit code (lesson 13.7)

All green? Then you can take a scanner's output and turn it into a defensible short list, which is the actual job.

Module 14 takes that list and attacks it. The findings stop being rows in a report and become the way into a machine you built yourself, which is a distinctly different feeling.

Pass criteria

Pass criteria​

Pass criteria