feat: Add GBL vulnerability assessment lab sheet

story_design/ink/lab_sheets/vulnerability_analysis.ink

@@ -0,0 +1,562 @@
+// Vulnerability Analysis Lab Sheet
+// Based on HacktivityLabSheets: introducing_attacks/8_vulnerability_analysis.md
+// Author: Z. Cliffe Schreuders, Anatoliy Gorbenko, Tom Shaw
+// License: CC BY-SA 4.0
+
+// Global persistent state
+VAR instructor_rapport = 0
+VAR vuln_scanning_mastery = 0
+
+// External variables
+EXTERNAL player_name
+
+=== start ===
+Vulnerability Assessment Specialist: Welcome, Agent {player_name}. I'm your instructor for Vulnerability Analysis and Assessment.
+
+~ instructor_rapport = 0
+~ vuln_scanning_mastery = 0
+
+Vulnerability Assessment Specialist: Vulnerability assessment is critical for efficiently identifying security weaknesses in systems before attackers find them.
+
+Vulnerability Assessment Specialist: While penetration testing involves manually researching and exploiting vulnerabilities, vulnerability scanning is an automated approach that quickly surveys systems for known security issues.
+
+Vulnerability Assessment Specialist: You'll learn to use industry-standard tools like Nmap NSE, Nessus, and Nikto - understanding their strengths, limitations, and when to use each.
+
+Vulnerability Assessment Specialist: Remember: these are powerful reconnaissance tools. Use them only on systems you're authorized to assess.
+
+~ vuln_scanning_mastery += 10
+
+-> vuln_scan_hub
+
+=== vuln_scan_hub ===
+Vulnerability Assessment Specialist: What aspect of vulnerability assessment would you like to explore?
+
++ [What is vulnerability scanning?]
+    -> vuln_scanning_intro
++ [Vulnerability scanning vs penetration testing]
+    -> scanning_vs_pentesting
++ [Nmap Scripting Engine (NSE)]
+    -> nmap_nse
++ [Using Nessus vulnerability scanner]
+    -> nessus_scanner
++ [Web vulnerability scanning with Nikto]
+    -> nikto_scanner
++ [Limitations of automated tools]
+    -> tool_limitations
++ [Show me the commands reference]
+    -> commands_reference
++ [Practical challenge tips]
+    -> challenge_tips
++ [I'm ready for the lab exercises]
+    -> ready_for_practice
++ [That's all for now]
+    #exit_conversation
+    -> END
+
+=== vuln_scanning_intro ===
+Vulnerability Assessment Specialist: Vulnerability scanning is an automated approach to identifying security weaknesses in systems.
+
+~ instructor_rapport += 5
+
+Vulnerability Assessment Specialist: Scanners typically perform or import network scans like port scans and service identification, then automatically check whether detected services contain known vulnerabilities.
+
+Vulnerability Assessment Specialist: They compare detected service versions against databases of known vulnerabilities - similar to what you did manually using CVE databases.
+
++ [How do vulnerability scanners work?]
+    Vulnerability Assessment Specialist: Most vulnerability scanners follow a standard process:
+
+    Vulnerability Assessment Specialist: First, they conduct or import a port scan to identify running services and their versions.
+
+    Vulnerability Assessment Specialist: Then they compare this information against databases of known vulnerabilities for those specific versions.
+
+    Vulnerability Assessment Specialist: Many also send probes to confirm vulnerabilities actually exist, not just assume based on version numbers.
+
+    Vulnerability Assessment Specialist: Some tests are potentially dangerous and might crash services, so most scanners offer a "safe mode" to avoid risky checks.
+
+    ~ instructor_rapport += 5
+
++ [Why use automated scanning?]
+    Vulnerability Assessment Specialist: Automated scanning has several advantages:
+
+    Vulnerability Assessment Specialist: It's fast - scanning hundreds of systems in the time it would take to manually test one.
+
+    Vulnerability Assessment Specialist: It's comprehensive - checking for thousands of known vulnerabilities systematically.
+
+    Vulnerability Assessment Specialist: It's repeatable - you can regularly rescan to catch newly introduced vulnerabilities.
+
+    Vulnerability Assessment Specialist: It reduces the risk of human error or overlooking obvious issues.
+
+    Vulnerability Assessment Specialist: However, it also has significant limitations we'll discuss.
+
+    ~ instructor_rapport += 5
+
+- -> vuln_scan_hub
+
+=== scanning_vs_pentesting ===
+Vulnerability Assessment Specialist: Penetration testing and vulnerability scanning are complementary but distinct approaches.
+
+~ instructor_rapport += 5
+
+Vulnerability Assessment Specialist: Penetration testing involves manual research, planning, and actual exploitation of vulnerabilities. It's deeper but slower.
+
+Vulnerability Assessment Specialist: Vulnerability scanning is automated, faster, and broader but shallower.
+
++ [What are the advantages of penetration testing?]
+    Vulnerability Assessment Specialist: Penetration testing has several key advantages:
+
+    Vulnerability Assessment Specialist: Very few false positives - if a tester successfully exploits a vulnerability, it's definitely real.
+
+    Vulnerability Assessment Specialist: Testers can chain vulnerabilities together in creative ways automated tools can't imagine.
+
+    Vulnerability Assessment Specialist: Human intuition can spot logical flaws and business logic vulnerabilities that scanners miss.
+
+    Vulnerability Assessment Specialist: However, there's always risk that an exploit may cause unintentional damage.
+
+    Vulnerability Assessment Specialist: And even skilled testers might miss something obvious if they're checking things manually.
+
+    ~ instructor_rapport += 5
+
++ [What are the advantages of vulnerability scanning?]
+    Vulnerability Assessment Specialist: Vulnerability scanning excels at:
+
+    Vulnerability Assessment Specialist: Speed - scanning entire networks in hours instead of days or weeks.
+
+    Vulnerability Assessment Specialist: Coverage - systematically checking for thousands of known vulnerabilities.
+
+    Vulnerability Assessment Specialist: Safety - tests can be configured to avoid dangerous probes that might crash services.
+
+    Vulnerability Assessment Specialist: Consistency - same tests run the same way every time.
+
+    Vulnerability Assessment Specialist: Cost-effectiveness - after initial setup, scanning is cheap to repeat regularly.
+
+    ~ instructor_rapport += 5
+
++ [Which approach is better?]
+    Vulnerability Assessment Specialist: The best security assessments use both!
+
+    Vulnerability Assessment Specialist: Start with vulnerability scanning to quickly identify low-hanging fruit and obvious issues.
+
+    Vulnerability Assessment Specialist: Then use penetration testing to go deeper, verify critical findings, and test how vulnerabilities can be chained together.
+
+    Vulnerability Assessment Specialist: Many organizations do frequent vulnerability scans with periodic penetration tests.
+
+    Vulnerability Assessment Specialist: Think of scanning as your smoke detector, and penetration testing as your fire drill.
+
+    ~ instructor_rapport += 5
+
+- -> vuln_scan_hub
+
+=== nmap_nse ===
+Vulnerability Assessment Specialist: The Nmap Scripting Engine (NSE) extends Nmap's capabilities beyond simple port scanning.
+
+~ instructor_rapport += 5
+
+Vulnerability Assessment Specialist: NSE allows Nmap to be extended with scripts that add service detection, vulnerability checking, and even exploitation capabilities.
+
+Vulnerability Assessment Specialist: Nmap is distributed with hundreds of scripts written in the Lua programming language.
+
++ [How do I use Nmap scripts?]
+    Vulnerability Assessment Specialist: The simplest way is to use the default script set:
+
+    Vulnerability Assessment Specialist: nmap -sC TARGET
+
+    Vulnerability Assessment Specialist: This runs all scripts categorized as "default" - safe, useful, and not overly intrusive.
+
+    Vulnerability Assessment Specialist: For vulnerability scanning specifically: nmap --script vuln -sV TARGET
+
+    Vulnerability Assessment Specialist: The vuln category includes scripts that check for known vulnerabilities.
+
+    Vulnerability Assessment Specialist: You can also run specific scripts: nmap --script distcc-cve2004-2687 TARGET
+
+    ~ instructor_rapport += 5
+
++ [Where are NSE scripts located?]
+    Vulnerability Assessment Specialist: All NSE scripts are stored in /usr/share/nmap/scripts/
+
+    Vulnerability Assessment Specialist: You can list them with: ls /usr/share/nmap/scripts/
+
+    Vulnerability Assessment Specialist: Each script is a .nse file. Looking at their code shows what they check for.
+
+    Vulnerability Assessment Specialist: For example, distcc-cve2004-2687.nse checks for the specific Distcc vulnerability.
+
+    Vulnerability Assessment Specialist: The scripts are organized by category: auth, broadcast, default, discovery, dos, exploit, fuzzer, intrusive, malware, safe, version, and vuln.
+
+    ~ instructor_rapport += 5
+
++ [How effective is NSE for vulnerability detection?]
+    Vulnerability Assessment Specialist: NSE vulnerability detection is useful but limited.
+
+    Vulnerability Assessment Specialist: The vuln scripts check for specific, well-known vulnerabilities - they're not comprehensive like dedicated vulnerability scanners.
+
+    Vulnerability Assessment Specialist: However, they're very useful for quick checks and are actively maintained by the Nmap community.
+
+    Vulnerability Assessment Specialist: Think of NSE as a lightweight vulnerability scanner - good for initial assessment but not a replacement for tools like Nessus.
+
+    ~ instructor_rapport += 5
+
+- -> vuln_scan_hub
+
+=== nessus_scanner ===
+Vulnerability Assessment Specialist: Nessus by Tenable is one of the most popular commercial vulnerability scanners in the industry.
+
+~ instructor_rapport += 5
+
+Vulnerability Assessment Specialist: It uses a client-server architecture with a web interface, and can scan for tens of thousands of vulnerabilities.
+
+Vulnerability Assessment Specialist: Vulnerability tests are written in NASL (Nessus Attack Scripting Language), and subscribers receive regular updates to vulnerability signatures.
+
++ [How do I use Nessus?]
+    Vulnerability Assessment Specialist: Access Nessus through its web interface at https://localhost:8834
+
+    Vulnerability Assessment Specialist: Login with the credentials provided (typically nessusadmin)
+
+    Vulnerability Assessment Specialist: Click "New Scan" and choose a scan template - Basic Network Scan is a good starting point.
+
+    Vulnerability Assessment Specialist: Enter your target IP addresses and click "Launch"
+
+    Vulnerability Assessment Specialist: Nessus will systematically test the targets and present results categorized by severity: Critical, High, Medium, Low, Info.
+
+    ~ instructor_rapport += 5
+
++ [What scan templates does Nessus offer?]
+    Vulnerability Assessment Specialist: Nessus offers various scan profiles for different purposes:
+
+    Vulnerability Assessment Specialist: Basic Network Scan - Good general-purpose scan for network services
+
+    Vulnerability Assessment Specialist: Advanced Scan - Allows detailed customization of what to check
+
+    Vulnerability Assessment Specialist: Web Application Tests - Focused on web vulnerabilities
+
+    Vulnerability Assessment Specialist: Compliance scans - Check systems against security policy standards
+
+    Vulnerability Assessment Specialist: Each template determines which vulnerability checks run and how aggressive the scanning is.
+
+    ~ instructor_rapport += 5
+
++ [How do I interpret Nessus results?]
+    Vulnerability Assessment Specialist: Nessus presents results with detailed information for each finding:
+
+    Vulnerability Assessment Specialist: Severity rating (Critical to Info) helps prioritize remediation
+
+    Vulnerability Assessment Specialist: CVE identifiers link to official vulnerability databases
+
+    Vulnerability Assessment Specialist: Plugin descriptions explain what was found and why it's a problem
+
+    Vulnerability Assessment Specialist: Solution sections provide remediation guidance
+
+    Vulnerability Assessment Specialist: References link to additional information and exploit code
+
+    Vulnerability Assessment Specialist: You can export results as HTML, PDF, or XML for reports or import into Metasploit.
+
+    ~ instructor_rapport += 5
+
++ [What's the difference between Basic and Advanced scans?]
+    Vulnerability Assessment Specialist: Basic scans use default settings optimized for speed and safety.
+
+    Vulnerability Assessment Specialist: Advanced scans let you customize:
+
+    Vulnerability Assessment Specialist: Which vulnerability checks to run
+
+    Vulnerability Assessment Specialist: Whether to perform "thorough tests" (slower but more comprehensive)
+
+    Vulnerability Assessment Specialist: Whether to show potential false alarms
+
+    Vulnerability Assessment Specialist: Advanced scans typically find more vulnerabilities but take longer and carry slightly higher risk of disruption.
+
+    ~ instructor_rapport += 5
+
+- -> vuln_scan_hub
+
+=== nikto_scanner ===
+Vulnerability Assessment Specialist: Nikto is a command-line web vulnerability scanner focused exclusively on web servers and applications.
+
+~ instructor_rapport += 5
+
+Vulnerability Assessment Specialist: While general scanners like Nmap and Nessus check web servers, Nikto specializes in web-specific vulnerabilities.
+
+Vulnerability Assessment Specialist: It scans for over 6,000 web security issues including dangerous CGI scripts, misconfigurations, and known vulnerable software.
+
++ [How do I use Nikto?]
+    Vulnerability Assessment Specialist: Nikto is straightforward to use:
+
+    Vulnerability Assessment Specialist: nikto -host TARGET_IP
+
+    Vulnerability Assessment Specialist: Nikto will automatically detect web servers on common ports and scan them.
+
+    Vulnerability Assessment Specialist: You can also specify a port: nikto -host TARGET_IP -port 8080
+
+    Vulnerability Assessment Specialist: Or scan SSL/TLS sites: nikto -host TARGET_IP -ssl
+
+    Vulnerability Assessment Specialist: The output shows each issue found with references to more information.
+
+    ~ instructor_rapport += 5
+
++ [What kinds of issues does Nikto detect?]
+    Vulnerability Assessment Specialist: Nikto looks for web-specific vulnerabilities:
+
+    Vulnerability Assessment Specialist: Outdated server software with known exploits
+
+    Vulnerability Assessment Specialist: Dangerous default files and directories (admin panels, config files)
+
+    Vulnerability Assessment Specialist: Server misconfigurations (directory listings, verbose errors)
+
+    Vulnerability Assessment Specialist: Known vulnerable web applications and frameworks
+
+    Vulnerability Assessment Specialist: Interesting HTTP headers that might reveal information
+
+    ~ instructor_rapport += 5
+
++ [How does Nikto compare to Nessus for web scanning?]
+    Vulnerability Assessment Specialist: Nikto and Nessus overlap but have different strengths:
+
+    Vulnerability Assessment Specialist: Nikto is specialized - it goes deeper on web-specific issues.
+
+    Vulnerability Assessment Specialist: Nessus is broader - it checks web servers along with everything else.
+
+    Vulnerability Assessment Specialist: Nikto is free and open source; Nessus commercial versions are quite expensive.
+
+    Vulnerability Assessment Specialist: For comprehensive web testing, use both! They often find different issues.
+
+    ~ instructor_rapport += 5
+
+- -> vuln_scan_hub
+
+=== tool_limitations ===
+Vulnerability Assessment Specialist: Understanding the limitations of automated tools is crucial for effective security assessment.
+
+~ instructor_rapport += 5
+
+Vulnerability Assessment Specialist: No single tool finds everything. Different tools detect different vulnerabilities based on their databases and testing methods.
+
+Vulnerability Assessment Specialist: All automated tools produce false positives and false negatives.
+
++ [What are false positives and false negatives?]
+    Vulnerability Assessment Specialist: False positives are vulnerabilities reported that don't actually exist.
+
+    Vulnerability Assessment Specialist: For example, a scanner might think software is vulnerable based on version number, but a patch was backported.
+
+    Vulnerability Assessment Specialist: False negatives are real vulnerabilities that scanners miss completely.
+
+    Vulnerability Assessment Specialist: This happens when vulnerabilities aren't in the scanner's database, or tests aren't configured to detect them.
+
+    Vulnerability Assessment Specialist: Penetration testing helps confirm scanner findings and find what was missed.
+
+    ~ instructor_rapport += 5
+
++ [Why don't scanners detect all vulnerabilities?]
+    Vulnerability Assessment Specialist: Several factors limit scanner effectiveness:
+
+    Vulnerability Assessment Specialist: Signature-based detection only finds KNOWN vulnerabilities in their databases.
+
+    Vulnerability Assessment Specialist: Zero-day vulnerabilities (unknown to vendors) won't be detected.
+
+    Vulnerability Assessment Specialist: Configuration issues and logical flaws often can't be detected automatically.
+
+    Vulnerability Assessment Specialist: Scanners might not test certain services if they're on non-standard ports.
+
+    Vulnerability Assessment Specialist: Safe mode settings might skip tests that could confirm vulnerabilities.
+
+    ~ instructor_rapport += 5
+
++ [How can different scanners miss different things?]
+    Vulnerability Assessment Specialist: Each scanner has different vulnerability databases and detection methods:
+
+    Vulnerability Assessment Specialist: Nmap NSE has a limited set of vulnerability scripts focused on network services.
+
+    Vulnerability Assessment Specialist: Nessus has an extensive database of checks but might not detect web-specific issues.
+
+    Vulnerability Assessment Specialist: Nikto specializes in web vulnerabilities but doesn't check other services.
+
+    Vulnerability Assessment Specialist: This is why security professionals run multiple scanners - each catches things others miss.
+
+    Vulnerability Assessment Specialist: Even then, manual testing is essential to find what all the scanners missed!
+
+    ~ instructor_rapport += 5
+
+- -> vuln_scan_hub
+
+=== commands_reference ===
+Vulnerability Assessment Specialist: Let me provide a comprehensive vulnerability scanning commands reference.
+
+~ instructor_rapport += 5
+
+Vulnerability Assessment Specialist: **Nmap NSE Scanning:**
+
+Vulnerability Assessment Specialist: Default script scan: nmap -sC TARGET
+
+Vulnerability Assessment Specialist: Vulnerability scripts: nmap --script vuln -sV TARGET
+
+Vulnerability Assessment Specialist: Specific ports: nmap --script vuln -sV -p 1-5000 TARGET
+
+Vulnerability Assessment Specialist: Specific script: nmap --script distcc-cve2004-2687 TARGET
+
+Vulnerability Assessment Specialist: List available scripts: ls /usr/share/nmap/scripts/
+
+Vulnerability Assessment Specialist: View script code: cat /usr/share/nmap/scripts/SCRIPT_NAME.nse
+
++ [Show me Nessus workflow]
+    Vulnerability Assessment Specialist: **Nessus Scanning:**
+
+    Vulnerability Assessment Specialist: Access web interface: https://localhost:8834
+
+    Vulnerability Assessment Specialist: Login: nessusadmin / nessusadmin01
+
+    Vulnerability Assessment Specialist: **Workflow:**
+
+    Vulnerability Assessment Specialist: 1. Click "New Scan"
+
+    Vulnerability Assessment Specialist: 2. Select scan template (Basic Network Scan or Advanced Scan)
+
+    Vulnerability Assessment Specialist: 3. Enter scan name and target IP addresses
+
+    Vulnerability Assessment Specialist: 4. For Advanced scans, configure: Thorough tests, Show potential false alarms
+
+    Vulnerability Assessment Specialist: 5. Click "Save" then "Launch"
+
+    Vulnerability Assessment Specialist: 6. View results: Click scan name → "Vulnerabilities" tab
+
+    Vulnerability Assessment Specialist: 7. Export results: "Export" → choose format (HTML, PDF, CSV, XML)
+
+    ~ instructor_rapport += 3
+
++ [Show me Nikto commands]
+    Vulnerability Assessment Specialist: **Nikto Web Scanning:**
+
+    Vulnerability Assessment Specialist: Basic scan: nikto -host TARGET_IP
+
+    Vulnerability Assessment Specialist: Specific port: nikto -host TARGET_IP -port 8080
+
+    Vulnerability Assessment Specialist: SSL/HTTPS: nikto -host TARGET_IP -ssl
+
+    Vulnerability Assessment Specialist: Multiple ports: nikto -host TARGET_IP -port 80,443,8080
+
+    Vulnerability Assessment Specialist: **Tips:**
+
+    Vulnerability Assessment Specialist: Output can be verbose - redirect to file: nikto -host TARGET > nikto_results.txt
+
+    Vulnerability Assessment Specialist: Check specific paths: nikto -host TARGET -root /admin/
+
+    ~ instructor_rapport += 3
+
++ [Show me comparison workflow]
+    Vulnerability Assessment Specialist: **Comprehensive Assessment Workflow:**
+
+    Vulnerability Assessment Specialist: 1. Start with Nmap service detection: nmap -sV -p- TARGET
+
+    Vulnerability Assessment Specialist: 2. Run Nmap vuln scripts: nmap --script vuln -sV TARGET
+
+    Vulnerability Assessment Specialist: 3. Launch Nessus Basic scan for broad coverage
+
+    Vulnerability Assessment Specialist: 4. Launch Nessus Advanced scan with thorough tests
+
+    Vulnerability Assessment Specialist: 5. For web servers, run Nikto: nikto -host TARGET
+
+    Vulnerability Assessment Specialist: 6. Compare results - note what each tool found uniquely
+
+    Vulnerability Assessment Specialist: 7. Verify critical findings with manual testing or exploitation
+
+    ~ instructor_rapport += 3
+
+- -> vuln_scan_hub
+
+=== challenge_tips ===
+Vulnerability Assessment Specialist: Let me give you practical tips for the vulnerability assessment challenges.
+
+~ instructor_rapport += 5
+
+Vulnerability Assessment Specialist: **Running Scans:**
+
+Vulnerability Assessment Specialist: Start Nmap vuln scans early - they take time to complete.
+
+Vulnerability Assessment Specialist: While Nmap runs, start your Nessus scans in parallel.
+
+Vulnerability Assessment Specialist: If Nessus is still initializing plugins, skip ahead to Nikto and come back.
+
++ [Tips for comparing results?]
+    Vulnerability Assessment Specialist: Document what each tool finds:
+
+    Vulnerability Assessment Specialist: Note which vulnerabilities Nmap NSE detects
+
+    Vulnerability Assessment Specialist: Count vulnerabilities by severity in Nessus (Critical, High, Medium, Low)
+
+    Vulnerability Assessment Specialist: Compare Basic vs Advanced Nessus scans - how many more does Advanced find?
+
+    Vulnerability Assessment Specialist: Check what Nikto finds that the others missed
+
+    Vulnerability Assessment Specialist: The lab has MULTIPLE exploitable vulnerabilities - see how many each tool detects.
+
+    ~ instructor_rapport += 5
+
++ [Tips for exploiting found vulnerabilities?]
+    Vulnerability Assessment Specialist: The lab includes vulnerabilities you've seen before (like Distcc) and new ones.
+
+    Vulnerability Assessment Specialist: Try exploiting vulnerabilities detected by the scanners to confirm they're real.
+
+    Vulnerability Assessment Specialist: There's a NEW privilege escalation vulnerability this week - a different sudo vulnerability.
+
+    Vulnerability Assessment Specialist: This time you don't know the user's password, so the previous sudo exploit won't work!
+
+    Vulnerability Assessment Specialist: Look for CVE-2021-3156 (Baron Samedit) - affects sudo versions 1.8.2-1.8.31p2 and 1.9.0-1.9.5p1
+
+    ~ instructor_rapport += 5
+
++ [Tips for privilege escalation?]
+    Vulnerability Assessment Specialist: After exploiting a service, check the sudo version: sudo --version
+
+    Vulnerability Assessment Specialist: The Baron Samedit vulnerability (CVE-2021-3156) might be present.
+
+    Vulnerability Assessment Specialist: This exploit works differently - it doesn't require knowing a password!
+
+    Vulnerability Assessment Specialist: You may need to upgrade your shell to Meterpreter first to use the Metasploit exploit.
+
+    Vulnerability Assessment Specialist: Search Metasploit: search baron_samedit or search CVE-2021-3156
+
+    Vulnerability Assessment Specialist: Use: exploit/linux/local/sudo_baron_samedit
+
+    ~ instructor_rapport += 5
+
++ [Troubleshooting tips?]
+    Vulnerability Assessment Specialist: If Nessus gives API access errors, clear your browser cache (Ctrl+Shift+Delete)
+
+    Vulnerability Assessment Specialist: If you can't access a web server, check Firefox proxy settings - disable the proxy or add exclusion for 10.*.*.*
+
+    Vulnerability Assessment Specialist: Some vulnerable services might be patched - try attacking all available services.
+
+    Vulnerability Assessment Specialist: Nessus scans can take 15-30 minutes - be patient!
+
+    Vulnerability Assessment Specialist: Compare results across all tools to see their different strengths and blind spots.
+
+    ~ instructor_rapport += 5
+
+- -> vuln_scan_hub
+
+=== ready_for_practice ===
+Vulnerability Assessment Specialist: Excellent! You're ready for comprehensive vulnerability assessment.
+
+~ instructor_rapport += 10
+~ vuln_scanning_mastery += 10
+
+Vulnerability Assessment Specialist: You'll use multiple industry-standard tools to assess the same target and compare their effectiveness.
+
+Vulnerability Assessment Specialist: This lab demonstrates an important lesson: no single tool catches everything. Layer your defenses and your assessments!
+
+Vulnerability Assessment Specialist: Remember: vulnerability scanners are reconnaissance tools. Use them only on authorized targets.
+
++ [Any final advice?]
+    Vulnerability Assessment Specialist: Be systematic. Run all the tools, document findings, and compare results.
+
+    Vulnerability Assessment Specialist: Pay attention to what each tool finds that others miss - this teaches you their strengths and weaknesses.
+
+    Vulnerability Assessment Specialist: Don't just collect scan results - verify critical findings by actually exploiting them.
+
+    Vulnerability Assessment Specialist: The limitations of these tools are as important as their capabilities. Real attackers won't stop at what scanners find.
+
+    Vulnerability Assessment Specialist: Take notes on severity ratings, CVE numbers, and remediation advice - these make great report content.
+
+    Vulnerability Assessment Specialist: Good luck, Agent {player_name}. Time to see what automated tools can and can't detect!
+
+    ~ instructor_rapport += 10
+
+- -> vuln_scan_hub
+
+-> END