You are conducting a penetration test and have identified several services running on a target system using Nmap and OpenVAS. After identifying the service versions, you research potential vulnerabilities and use Metasploit to select appropriate exploits. Which of the following best evaluates the next step in exploiting the vulnerabilities?

• A. Patch the service to mitigate vulnerabilities.
• B. Research each identified service and version further to determine if the vulnerability is exploitable in the current system configuration, then test the exploit in a controlled manner.
• C. Attempt automated exploitation across all services.
• D. Notify the client and stop testing.

Answer: (B)

Verifying that a vulnerability can actually be exploited in the target environment before launching any exploit is the essential next step. Even if a service version matches a known vulnerable state, real-world factors like patch level, configuration, access controls, user privileges, and network defenses can prevent exploitation or alter its impact. So, you first research each identified service and version to determine if the vulnerability is exploitable given the current setup, prerequisites, and mitigations. This involves checking advisories for required conditions, validating prerequisites (such as authentication or specific component versions), and planning a targeted, controlled test.

Only after confirming exploitable conditions should you attempt the exploit in a safe, scoped manner—preferably in a test or staging environment or with explicit authorization and containment in your live-testing scope. This approach minimizes risk, avoids crashing systems, and provides accurate results about real risk.

Remediation steps like patching are corrective actions, not part of the exploitation test. Automating exploitation across all services is unsafe and inappropriate during a careful assessment, and simply stopping testing to notify the client ends the engagement prematurely and loses the opportunity to demonstrate actual risk.