Homework
Three tasks to tune your scanner-triage workflow.
Complete the lab before starting.
Task 1 — Burp Re-Scoring
Objective
Disagree with the scanner — with evidence.
Instructions
- Pick five Burp findings from the lab output.
- For each, re-score severity using CVSS 3.1 yourself. Justify every metric choice.
- Compare to Burp's rating. Note every disagreement and why yours is more accurate.
Deliverable
Comparison table with CVSS vectors.
Task 2 — Chain Builder
Objective
Write code that turns a scanner finding into a working proof.
Instructions
- For your #1 finding, write a Python requests script that reproduces it end-to-end.
- Include a --verify mode that returns exit 0 if vulnerable, 1 if not.
- No destructive actions: the script should only read, never write or delete.
Deliverable
reproduce.py with clear output.
Task 3 — Scanner Comparison
Objective
Understand which scanner is right for which job.
Instructions
- Build a matrix: rows = scanners (Nikto, Gobuster, Burp, manual), columns = vuln classes (info disclosure, auth bypass, injection, etc.).
- Fill in which scanner is strongest for each cell.
- Write a one-paragraph guide: "if I only have 30 minutes, I run these tools in this order."
Deliverable
Matrix + paragraph.