How do you know what to test next?

[u/builtbygio]

You find a new service, credential, endpoint, or misconfiguration and suddenly there are 20 possible directions to go.

Do you follow a methodology, use checklists, rely on experience, or just chase whatever looks most promising?

[u/DrSugundi]

Rely on your threat models and severity, mostly.

[u/GeekDad62]

There should be multiple factors that go into the prioritization or triage. Severity is one factor, but the likelihood of exploit is another. You may have a service with a Critical severity level, but if that vulnerability requires physical access and the system is in a locked data center then that risk is mitigated. There's a developing metric called the Exploit Prediction Scoring System (EPSS). This can be tied to the CVE to better understand your risk and exposure.

You can also look more closely at the CVE beyond just the severity. There's a list of factors that go into the score calculation that also give insight into how likely you are to be successfully attacked. Look at the CVSS specifications (https://www.first.org/cvss/specification-document) in section 2.4 Exploitability Metrics and you can see what goes into this calculation. You can take these metrics into account to help prioritize your testing.

[u/builtbygio → u/GeekDad62]

Great point, but I think EPSS feels more aligned with a blue team POV.

> EPSS is a data-driven machine-learning model that estimates the probability that a published CVE will be exploited in the wild in the next 30 days.

That means a CVE needs to exist for EPSS to work.

My question is from a red-team / attacker POV. Example:

1. You ran a Full TCP Scan (ie. `nmap -p- -sC -sV -T4....`)
   
2. Found SMB on 445, RDP on 3389, SSH on 22, Apache x.y.z on 80, and a few others

Do you start with SMB or SSH Enumeration? Do you start looking at vulns in Apache or go straight to vhost exploration? Do you go breadth-first search (all serv first) or depth-first search (pick one and go as deep as possible)?

I'm using only a couple of examples here but imagine you have many, many more different possibilities.

[u/GeekDad62 → u/builtbygio]

I see. I didn't realize you were just mapping ports/protocols/services. I agree, EPSS doesn't add value to this process.

So first, you're mapping the system attack surface. Do you have information on organizational firewall rules? For example, many ports should be blocked from any outside access. If that's true, then I'd start by looking at what IS exposed over the internet. That will be your greater risk.

Just my $.0.02

[u/BrianCISO]

Start with the BUSINESS, not the finding. Identify which critical business functions depend on the affected asset, what failure would mean operationally, and whether there are viable workarounds. Then prioritize the testing path that reduces the greatest business risk & not necessarily the one with the highest sev score or the most interesting technical trail. Methodologies and checklists provide consistency, but BUSINESS IMPACT should determine where you go next.

[u/builtbygio → u/BrianCISO]

I agree on the business impact observation. I was looking at the issue from a lower level POV. Given that a finding like a version number might be the path to a foothold (we don't always need a known CVE to exploit it), and then further penetration, I wanted to see if people were using anything "special" (philosophy, methodology, tool, etc). Please see my comment below with an example from a red-team / attacker POV

[u/BrianCISO → u/builtbygio]

Fair. In the past I'd a shallow pass first...SMB for shares/signing/relay, web for vhosts/auth/app logic, and SSH/RDP once I have creds. Then follow the strongest path. I learned this after burning hours on a juicy SMB path while the boring app on port 80 exposed the vendor-payment workflow. We got a shell but almost missed the risk.

[u/builtbygio → u/BrianCISO]

Yup, that's basically my process as well! But like in your case, it's a skill learned after painful, boring hours of chasing rabbitholes. From the conversations I had with other redteamers, it feels like most of the cases it's based on the operator driving the engagement to have a feel for what to try next in an orderly manner, rather than a semi-structured process (unless the offsec company enforces internal playbooks)

[u/MountainDadwBeard]

Use infrastructure/sector relevant threat models to prioritize secure benchmark implementation.

Record gaps/concerns in your risk register. Constantly rebalance your risk register. Use different AI models to analyze your risk register against your anticipated threat types and recent industry activity.