0.4 Recognition practice

Strategy map | Master Notes | Study sequence

These are unanswered paper exercises, not target assignments. All evidence is hypothetical and abbreviated; none records a completed attack or practical competence. Attempt a case before opening the corresponding guide.

For every case, write:

1. Your established access and the facts actually supported by the evidence.
2. The precise recognition clue and candidate method.
3. The missing enabling condition, the exact check you would select, and the decisive evidence you would expect.
4. Your decision: enabled after validation, ruled out in this context, or inconclusive. State how one changed condition would change the next action.

Do not substitute an attack name for prerequisite reasoning.

0.4.1 Case 01 — Network discovery

Your starting access is a Kali workstation with an assigned target IP. A default TCP scan reports ports 22 and 80 open. Host discovery succeeds. No UDP scan or full TCP scan has been recorded.

A draft note says: “The target has only SSH and HTTP; discovery is complete.”

What investigation produced useful clues, and what coverage claim is unsupported?

0.4.2 Case 02 — Service access

A supplied domain password authenticates to SMB. You can list a share and its filenames. Opening a configuration file returns access denied. No execution-capable service authorization has been checked.

A draft note says: “We have remote execution and the database credentials.”

Which access boundaries have actually been crossed, and which checks come next?

0.4.3 Case 03 — Web mapping

An HTTP path-discovery run returns status 200 for many random names. A nonsense path and the home page have matching titles, sizes and body text. One export endpoint returns a different content type and a consistent application-specific response.

How would you separate a useful route clue from soft-404 noise? What would you inspect before selecting an exploit?

0.4.4 Case 04 — Web exploitation

An authenticated upload accepts a file with a script extension. Its returned URL downloads the exact source text rather than running it. The application stores the file on a separate static-content host.

Does accepted upload establish code execution? Which conditions would have to change, and what alternative capability might still exist?

0.4.5 Case 05 — Credential material

A capture contains an NTLM challenge-response exchange. A colleague proposes placing the complete captured response into a tool option that expects an NT hash.

How do you classify the material? Which recovery or use paths require different prerequisites?

0.4.6 Case 06 — Public exploit adaptation

A reviewed public proof of concept exits with a Python import error before sending any request. The product name resembles the target banner, but the target's affected component and exact build have not been established.

A draft note says: “The exploit failed, so the target is patched.”

Which failure boundary was reached? What evidence is needed before making a vulnerability claim?

0.4.7 Case 07 — Shells and sessions

An application command primitive is confirmed. A staged payload contacts a listening socket, but no usable command session follows. The listener is a plain TCP listener, not a handler for that staged payload.

Which observed result is real, what remains unproved, and how would you distinguish a handler mismatch from a blocked callback?

0.4.8 Case 08 — Linux privilege escalation

A low-privilege account can modify a backup script. The script contains administrative-looking commands. You have not identified a privileged scheduler, service, executable owner context or manual administrator trigger that consumes it.

Why is this a candidate rather than confirmed escalation? Where would you investigate the consumer and trigger?

0.4.9 Case 09 — Windows privilege escalation

A service executable path contains spaces and is unquoted. All earlier executable-prefix locations are either protected from your account or occupied by existing files you cannot replace. You have not found a writable loaded dependency or service configuration right.

What does the formatting clue establish? Which effective permission decides whether this particular method is available?

0.4.10 Case 10 — AD mapping

Your domain account can bind to LDAP. A broad query returns a size-limit warning. No service principal names appear in the returned subset.

A draft note says: “The domain has no service accounts.”

How would you repair enumeration coverage and preserve the distinction between an empty result and an incomplete result?

0.4.11 Case 11 — AD identity transition

A directory account has userAccountControl value 0x00400202. For this exercise, 0x00400000 means preauthentication is not required, 0x00000200 identifies a normal account, and 0x00000002 means the account is disabled.

A draft note selects the account solely because the preauthentication flag is present.

Which additional flag changes the decision? What identity state and KDC result would you need before claiming a usable path?

0.4.12 Case 12 — Lateral movement

The same domain password is accepted for an SMB share, but WinRM returns an authorization denial. You have not checked remote-management group membership or endpoint policy.

A draft note says: “The password is wrong.”

Which fact supports authentication, which result concerns authorization, and what other movement routes remain conditional?

0.4.13 Case 13 — Pivoting

An application inside a private subnet is reachable through your SOCKS proxy. An exploit's reverse connection never arrives. The payload was configured to call a workstation address for which no return route or reverse forward has been established.

Why does successful proxied access not establish a working callback path? Draw the separate paths and choose the missing check.

0.4.14 Case 14 — Execution troubleshooting

A document reaches the intended host. Office opens it in a restricted state and blocks its macro. No command process or outbound connection is observed.

A draft note recommends changing listener ports repeatedly.

At which boundary did execution stop? What evidence would justify investigating connectivity instead?

0.4.15 Case 15 — Completion and reporting

Your archive opens successfully and contains the expected screenshots and notes. In the rendered PDF, one reproduction command is clipped, and a privilege screenshot does not show the relevant host identity.

A draft note says: “The archive is valid, so the report is ready.”

Which checks concern file integrity, which concern reproducibility and attribution, and what must be corrected before completion?

0.4.16 Review after attempting a case

Use the topic discovery workflows to trace your proposed investigation. Compare the matching entry's discovery action, synthetic evidence, exact clue, missing checks and three decision outcomes with your answer. Record uncertainty rather than treating a plausible attack name as proof.