Scope, Hosts, and Vulnerability Management

Perimeter with scope

scope defines what is authorized. The agent and certain policies refer to it.

scope add 127.0.0.1
scope add 10.0.0.0/24
scope add app.labcorp.local
scope list
scope remove 10.0.0.0/24

Best practice: scope too broad invites drift; too narrow blocks legitimate validations. Align it word for word with the mandate.

Host mapping --- host

host add 127.0.0.1 --note "DVWA isolated test environment"
host add 127.0.0.1 --os linux --arch x64
host services 127.0.0.1
host list
host show 127.0.0.1

After a port scan, document discovered services. This layer partially replaces an external spreadsheet and feeds the campaign graph.

Typical workflow after scanner

1. scanner -u http://target produces findings.
2. For each new service: host add + host services.
3. Confirmed vulnerabilities go into vuln add.

Vulnerability registry --- vuln

vuln list
vuln show <id>
vuln add --host 127.0.0.1 --title "SQLi DVWA" --severity high
vuln search sqli

Each vulnerability should include: title, severity, source module, minimal proof, status (new, confirmed, false positive, fixed).

Finding lifecycle

1. Detected --- scanner or manual module output.
2. Confirmed --- check/run or manual validation.
3. Documented --- vuln add, proxy capture, HTTP excerpt.
4. Exploited (isolated test environment) --- session or impact proof.
5. Retested --- agent retest or module after patch.

Integration with campaign

campaign --preview reads hosts, services, and vulns from the active workspace to propose an attack graph. Without structured data, the plan will be sparse.

workspace use dvwa-recon
host list
vuln list
campaign --preview
campaign --formats plan,report --max-steps 40

Data setup

workspace create client-2026-q2
workspace use client-2026-q2
scope add 127.0.0.1
lab start dvwa-basics

scanner -u http://127.0.0.1 --threads 10
host add 127.0.0.1 --note "DVWA Low"
host services 127.0.0.1

use scanner/http/security_headers_detect
set rhost 127.0.0.1
run
# Record the finding in vuln if confirmed