The Methodology · 2.4
🔓 Exploitation & Post-Exploitation
Proving impact responsibly — and why access is the beginning, not the end⏱ ~3 min
Exploitation — Proving a Weakness Is Real
A vulnerability is only a theory until it's demonstrated. Exploitation is safely using an identified weakness to prove it's genuinely exploitable — turning 'this looks vulnerable' into 'here's proof.' In an ethical engagement, this is done carefully, within scope, and without causing damage.
The Ethical Tester's Restraint
🔒 SecurityA real attacker exploits to cause harm; an ethical tester exploits only enough to prove the risk, then stops. You demonstrate that you *could* access sensitive data — you don't steal it, damage systems, or disrupt the business. The moment you've proven the point, you document it and move on. Restraint is the profession.
Post-Exploitation — 'So What?'
Getting in is rarely the end. Post-exploitation answers the crucial question: what's the actual business impact of this access? A foothold on a forgotten test server matters far less than one that leads to customer data. This phase assesses how bad the weakness really is.
- •Privilege escalation — could a low-level foothold become full administrator control?
- •Lateral movement — could an attacker pivot from this machine to more valuable ones?
- •Data access — what sensitive information is actually reachable from here?
- •Persistence (in theory) — could an attacker maintain access? (Documented, not actually planted in ethical tests)
Common Vulnerability Categories
| Category | What Goes Wrong |
|---|---|
| Outdated software | Known vulnerabilities in unpatched versions (the most common finding) |
| Weak/default credentials | admin/admin, unchanged default passwords, reused passwords |
| Misconfiguration | Overly-permissive settings, exposed admin panels, default configs left on |
| Injection flaws | User input treated as commands (covered in the Web unit) |
| Broken access control | Users can reach data or actions they shouldn't |
★ FactThe overwhelming majority of real breaches don't use exotic 'zero-day' exploits. They use boring, preventable weaknesses: unpatched software, weak passwords, and misconfigurations. This is good news for defenders — fixing the basics stops most attacks.
🧠Quick Checkfirst try = +5 XP
How does an ethical tester's exploitation differ from a criminal's?
🎮 Practice what you learned
⭐ 0 XP🔥 0 days