Lion Cipher Lab
Consolidate and de-duplicate scanner findings into one report
- Penetration Testing / Red Team
- Intermediate
- ~50 min
- Free · no account required
Why it matters
Real assessments never run one scanner. A web test might pair a general vulnerability scanner, a template-based scanner, and a TLS checker; an internal test stacks a network scanner on an authenticated one. Each produces its own export in its own format, and they overlap heavily and disagree constantly — the same issue appears three times under three names and two different severities, while each tool also finds things the others miss. If you hand a client the raw union of those outputs, you have given them a padded, contradictory list that buries the handful of things that matter and quietly…
What you'll learn
- merging findings from multiple scanners into one list
- defining a de-duplication key (host:port + CVE or normalized title)
- reconciling conflicting severities across tools
- using cross-scanner corroboration to prioritize triage
- reading CSV and JSON scanner exports with stdlib Python
- producing a clean, severity-sorted consolidated report
- how finding-management tools (DefectDojo) define a duplicate
Steps in this lab
- The problem: three scanners, one truth
- Define what makes two findings 'the same'
- Create the sample scanner exports
- Write the consolidation tool
- Run it and read the consolidated report
- Know the limits, and when to graduate to a platform