Use a Kioptrix lab to practise one traceable assessment loop: define the target and question, collect an observation, test an explanation and write only the conclusion your evidence supports. A completed lab is not equivalent to a client engagement.
Choose the right route before starting
Looking for the machine commonly called Level 3? Use the Level 3 download and setup guide. This page covers a general assessment workflow; it is not a release-specific exploit walkthrough. Use the release index to confirm which image you actually have.
Record permission, image identity, intended virtual network, current target identity and recovery point. Keep the intentionally vulnerable VM away from everyday devices and public exposure. Resolve uncertain identity before active testing.
Follow a question-to-finding sequence
| Stage | Produce | Check before moving on |
|---|---|---|
| Scope | Target, permitted activity and stop condition | Can you distinguish this guest from the host and other devices? |
| Observe | Original output and collection conditions | Did the action finish, and what did it cover? |
| Interpret | A claim plus alternatives | Does the evidence establish the claim or only suggest it? |
| Validate | One permitted distinguishing check | Are prerequisites, expected result and recovery understood? |
| Report | Supported finding or explicit unresolved question | Can a reader connect every conclusion to an artifact? |
Worked example: a directory listing
Illustrative example. The confirmed lab application returns a directory listing during an authorized content review. The observation is the visible response under that URL, time and access context. Record the request, response and allowed content you actually reviewed.
A supported conclusion might be that directory indexing exposes those visible lab filenames. It does not establish that credentials were exposed, that every directory is readable or that the entire application is compromised. If you did not inspect a file, do not claim its contents.
A remediation suggestion can address the observed behavior: restrict unnecessary listing and review intended access. A retest should repeat the same permitted observation under comparable conditions. Keep remediation advice separate from a claim that a fix was implemented.
Use an evidence-linked finding record
Question and authorized scope: Release, target identity and current state: Access context and collection conditions: Observation and original artifact ID: Interpretation and alternative explanations: Permitted follow-up and expected distinction: Actual result / incomplete or unresolved conditions: Impact demonstrated in this lab: Impact not established: Suggested correction and comparable retest: Assistance used:
A failed or inconclusive check can still produce a useful record. The deliverable is an accurate explanation, not a required shell or a predetermined severity.
Keep adjacent tasks separate
Use the task planner before working, the decision tree when choosing a missing observation, and the restart checklist before changing the VM state. For a release-specific hint, choose the matching walkthrough rather than merging results from different images.
Sources and evidence limits
NIST SP 800-115 provides context for planning tests, analyzing findings and mitigation. The Nmap reference explains scan coverage and result types. The sequence and example here are editorial learning aids. No new VM execution, client impact or professional qualification is claimed.
Editorial revision: October 25, 2026. Replaced repetitive introductions with a task-specific workflow, comparison and illustrative example. No new VM execution, measured learning effect or hiring outcome is claimed. Author and evidence policy.
Scoped assessment practice record
Use this record for the specific task in this guide. Copy the fields into your notes and complete them with the actual conditions, evidence and assistance used in your own work.
Field guidance for this record
| Field | What to record | Your evidence / next check |
|---|---|---|
| Permitted objective | Name the bounded task and excluded systems. | To complete |
| Observation | Keep the evidence that motivated an explanation. | To complete |
| Allowed check | Record the action and its stopping condition. | To complete |
| Finding limit | Separate demonstrated result from untested impact. | To complete |
Edit the template below with your own dated observations. Bracketed prompts are guidance, not evidence. This page does not automatically save or upload your entry; download it before leaving or reloading.
Template ready. Replace the prompts with your record, then download a copy.
Worksheet usability update — October 23, 2026: added an editable record and a download of its current contents. This does not verify the article’s sources or perform the lab exercise.
Next action: Complete one traceable question-to-conclusion loop. Keep the original record so a later correction does not make an earlier assumption look like an established fact.
Related task: Continue with Kioptrix Level 1 Methodology: Questions and Evidence when you need that separate part of the workflow.
Worksheet change record — October 20, 2026
Added four task-specific fields, a next action and a related guide. This is an editorial working aid, not a completed lab result or a validated skill assessment. Existing source-review dates retain their own scope; this addition is not a new fact-check of every statement.