For Teachers · Back to the Module · Print with your browser's Print command.

A4 Teacher Answer Key: Building Your Own Check

Teacher Answer Key (about 30 minutes, Applied level)

Name: ______________________ Class: __________ Date: __________

Read first: A1

Learning Objectives

• [ ] Describe the parts of an OpenVAPT check.
• [ ] Write a read-only detection through the System interface.
• [ ] Prove a check with vulnerable and hardened test cases.

Key Terms

Write each definition in your own words.

• Detection Logic: The exact rules a check uses to decide whether a weakness is present.
• Test Fixture: Prepared data or a simulated environment used to test software repeatably.
• False Positive: A reported problem that is not real.

Lab Tasks

Use only the simulated lab or a machine your teacher has authorised.

1. Read internal/checks/host/logging_time.go and internal/check/check.go.
2. Follow the steps on the Learn page to add a small check, then run go test ./...

Self-Check Questions

1. How does OpenVAPT show a check does not raise false positives?

• [x] a) It runs the check against a hardened simulated server, which must pass
• [ ] b) It asks users
• [ ] c) It cannot
• [ ] d) It compares results with another scanner
• Answer: a. The hardened lab must stay silent for every check.

1. Why can a check not modify the system?

• [ ] a) Developers promise not to
• [x] b) The System interface offers no write or restart operations
• [ ] c) Go forbids it
• [ ] d) Checks run inside a container
• Answer: b. Read-only is enforced by the interface design.

1. What happens when a check is registered without documentation or citations?

• [ ] a) It is accepted with a warning
• [x] b) Registration refuses it
• [ ] c) It is marked Low severity
• [ ] d) It is hidden from reports
• Answer: b. Every check must carry its rationale, fix and references, or it is refused.

1. What network access does a check get?

• [ ] a) Any host on the internet
• [x] b) Loopback-only HTTP
• [ ] c) Any host on the local network
• [ ] d) None except DNS
• Answer: b. The System interface allows HTTP to loopback only, so a check cannot reach another machine.

1. How are false negatives caught before release?

• [x] a) The vulnerable lab must trigger the check, or the engine tests fail
• [ ] b) Users report them
• [ ] c) They cannot be caught
• [ ] d) By running the check on production servers
• Answer: a. If the vulnerable lab does not trigger the check, the tests fail until it does.

Reflection

Which finding from this module would matter most on a server you are responsible for, and why?

________________________________________________________________

Sources

• OpenVAPT source code: https://github.com/OpenVAPT/openvapt

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under TEACHING.md. Please cite OpenVAPT: see CITING.md or openvapt.com/cite.html. OpenVAPT is not affiliated with, and is not endorsed by, this institution or any third party named in this material. Pre-release versions may be wrong or unstable. Use at your own risk. If you adapt this material, say where you changed it.