Phase 1 left three leaks. This step checks all three, the same way you first found them, and confirms they’re shut.
Leak 1: the readable Telnet login
Telnet is gone, so there’s nothing to connect to.
copydocker compose exec client-a nmap -n -p 23 10.10.20.10
Leak 2: the readable web password
Capture a web login and search it for the password, as in Phase 1 step 4. It now goes over HTTPS.
copydocker compose exec -d fw tcpdump -i any -nn -U --immediate-mode -w /captures/recheck.pcap "tcp port 80 or tcp port 443"
copydocker compose exec client-a curl -sk -o /dev/null -d "username=webadmin&password=Web-Only-7788" https://10.10.20.10/login
copydocker compose exec fw pkill tcpdump
copydocker compose exec fw sh -c "tcpdump -r /captures/recheck.pcap -nn -A 2>/dev/null | grep -ac Web-Only-7788"
Leak 3: the password that opened the shell
The server no longer accepts a password for SSH.
copydocker compose exec client-a ssh -o PreferredAuthentications=password -o PubkeyAuthentication=no netstate@10.10.20.10 true
All three at once
copydocker compose exec client-a sh /lab/tests/check-phase3.sh
You should see
- Leak 1:
23/tcp closed(orfiltered). - Leak 2:
0. The password isn’t in the capture. - Leak 3:
Permission denied (publickey). - The check:
7 passed, 0 failed.
What it means
Every weakness Phase 1 found is now closed, checked the same way it was first shown. That before and after, run in the same lab, is the proof: not that the fixes should work, but that they do.