Overview
Scanning findings, like all findings, must be backed by evidence. This capstone lesson covers capturing scan evidence and consolidates the scanning module.
Learning objectives
- Explain what constitutes scan evidence.
- Describe recording scan results responsibly.
- Consolidate the scanning module.
Core concept
Scan evidence is the documented record of scanning activity and results: what was scanned, when, with what approach, and the (validated) findings — open ports, detected services/versions, and their interpretation. Good evidence makes results reproducible and credible, ties findings to the specific target and time, and feeds enumeration, vulnerability assessment, and the report. As always, evidence is recorded accurately and any sensitive information handled per the rules of engagement.
How it works
As scanning proceeds, the tester records the targets, timing, and approach, and captures the results — the port states, detected services and versions, and the interpreted picture — noting which findings were validated (versus raw or uncertain). This documented evidence lets the owner reproduce and trust the results, supports deconfliction (matching scan traffic to the tester's activity log), and provides the factual basis for later phases and the report. Evidence should be organized so each finding is traceable to how and when it was obtained.
Practical example
After scanning an in-scope host, the tester records: the target and scan time, the approach used, and the validated results (open ports 22/80/443 with detected services/versions, filtered ports indicating a firewall, and the interpretation that it is a firewalled web+SSH host). This evidence package is organized and timestamped, ready to drive enumeration and to appear in the report with clear traceability. Uncertain or unvalidated items are marked as such rather than presented as confirmed.
Cybersecurity relevance
Scan evidence underpins credible, reproducible, and accountable assessment: it lets owners verify results, supports deconfliction with their logs, and forms the basis of enumeration and reporting. Poorly documented scans produce unverifiable claims; well-documented, validated scan evidence produces trustworthy findings. This consolidates the scanning module — port concepts, service detection, scan interpretation, false positives, and evidence — which together map a target's exposed services accurately and reproducibly, feeding the enumeration and vulnerability-assessment phases.
Common mistakes
- Not recording what was scanned, when, and how, hurting reproducibility and deconfliction.
- Presenting unvalidated/uncertain results as confirmed in evidence.
- Disorganized evidence that does not tie findings to how they were obtained.
Key takeaways
- Scan evidence documents targets, timing, approach, and validated results (ports, services/versions, interpretation), making findings reproducible and credible.
- It supports owner verification, deconfliction with activity logs, and feeds enumeration, vulnerability assessment, and reporting; sensitive data is handled per the ROE.
- It consolidates scanning (port concepts, service detection, interpretation, false positives, evidence) into an accurate, reproducible map of exposed services.
Check your understanding
- What should scan evidence record to make results reproducible and credible?
- How does distinguishing validated from unvalidated results in evidence improve the assessment?