For Teachers · Back to the Module · Print with your browser's Print command.

F2 Worksheet: What VAPT Is, and Doing It Legally

Student Worksheet (about 20 minutes, Foundations level)

Name: ______________________ Class: __________ Date: __________

Read first: F1

Learning Objectives

• [ ] Explain the difference between vulnerability assessment and penetration testing.
• [ ] Describe the phases of NIST SP 800-115 and where OpenVAPT stops.
• [ ] Explain why written authorisation and scope come before any testing.

Key Terms

Write each definition in your own words.

• VAPT: ______________________________________________
• Vulnerability Assessment: ______________________________________________
• Penetration Testing: ______________________________________________
• Scope: ______________________________________________
• Rules of Engagement: ______________________________________________
• NIST SP 800-115: ______________________________________________
• False Positive: ______________________________________________

Lab Tasks

Use only the simulated lab or a machine your teacher has authorised.

1. Run: openvapt scan --dry-run and read every operation it would perform.
2. Find the loopback guard in internal/scope/scope.go and its test. Explain why host names are refused.
3. Write a one-paragraph scope statement for assessing your own test server.

Self-Check Questions

1. What does a penetration test do that a vulnerability assessment does not?

• [ ] a) Rates findings by severity
• [ ] b) Attempts to exploit weaknesses to prove impact
• [ ] c) Produces a report
• [ ] d) Looks for known weaknesses

1. Which NIST SP 800-115 phase does OpenVAPT deliberately leave out?

• [ ] a) Discovery
• [ ] b) Reporting
• [ ] c) Attack
• [ ] d) Planning

1. What must exist before testing a system you do not own?

• [ ] a) A fast internet connection
• [ ] b) Written authorisation with a defined scope
• [ ] c) A paid scanner licence
• [ ] d) A tool that is free to use

1. Which scope does OpenVAPT enforce in its code?

• [ ] a) Any host on the local network
• [ ] b) Only the machine it runs on
• [ ] c) Any host named on the command line
• [ ] d) Any host covered by written authorisation

1. Which of these is a methodology for testing web applications?

• [ ] a) OWASP Web Security Testing Guide (WSTG)
• [ ] b) CVSS v3.1
• [ ] c) CWE
• [ ] d) Directive 2013/40/EU

1. You run OpenVAPT on a server you rent but do not control. Does its loopback-only scope make the test lawful?

• [ ] a) Yes, local scans are always lawful
• [ ] b) No, you still need the right to run it on that machine
• [ ] c) Yes, if the server is in another country
• [ ] d) Only if the scan finishes quickly

Reflection

Which finding from this module would matter most on a server you are responsible for, and why?

________________________________________________________________

Sources

• NIST SP 800-115, Technical Guide to Information Security Testing and Assessment: https://csrc.nist.gov/pubs/sp/800/115/final
• OWASP Web Security Testing Guide: https://owasp.org/projects/web-security-testing-guide
• Penetration Testing Execution Standard (PTES) Technical Guidelines: https://pentest-standard.readthedocs.io/en/latest/

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under TEACHING.md. Please cite OpenVAPT: see CITING.md or openvapt.com/cite.html. OpenVAPT is not affiliated with, and is not endorsed by, this institution or any third party named in this material. Pre-release versions may be wrong or unstable. Use at your own risk. If you adapt this material, say where you changed it.