This five-session plan keeps one Kioptrix Level 1 investigation manageable when study time is limited. Each session has an input, an artifact to save, a stopping condition and a resume note. Split or repeat sessions as needed; five sessions is an organizing example, not a completion deadline.
Use the seven-session roadmap for a broader foundation sequence. This page assumes you can navigate Linux files, identify an IP address and explain which VM is Kali and which is the intentionally vulnerable target.
Plan around evidence, not a root-access deadline
| Session | Required input | Artifact before leaving | Repeat if |
|---|---|---|---|
| 1. Baseline | Image, compatible host and lab network plan. | Environment manifest and recovery reference. | Boot, boundary or target identity remains uncertain. |
| 2. Inventory | Confirmed target identity and route. | Saved scan and service inventory with coverage limits. | The scan skipped the target or did not complete. |
| 3. Applicability | One directly observed service behavior. | Lead with prerequisites and a bounded next test. | The claim rests only on an unverified version string. |
| 4. Validation | Known starting state and explicit hypothesis. | Actual result, effects and unresolved conditions. | You cannot tell what changed or why the result matters. |
| 5. Reproduction | Selected evidence and recorded assistance. | Reproduction report and one next learning task. | The report depends on memory or implies unobserved success. |
What to do in each session
Session 1: record a working baseline
Use Level 1 download checks and the import guide to identify the image and resolve compatibility before boot. Review every adapter on Kali and the target, including extra NAT or bridged connections. Confirm the addressing method and tie the target address to its VM identity.
Record the host architecture, hypervisor/version, extracted file set, adapter modes, target MAC and current address. Create a recovery point if supported and record its state. A snapshot is not a substitute for keeping the original download or a separate backup.
Resume note: “From baseline [name], recheck the target identity and save a scoped baseline scan.” If identity is unresolved, the next session starts with networking, not scanning.
Session 2: save an inventory you can read tomorrow
Choose scan options you can explain using the Nmap reference. Preserve the exact command, transport, ports, completion status and raw output. List the responding services and keep untested coverage visible.
Choose one service to inspect manually. For a web service, record the URL, response and a comparison with a nonexistent path. For another protocol, identify the specific observable response rather than assuming that its port number is the product identity.
Resume note: “Read evidence [ID]; resolve [one uncertainty] on [service].” Do not substitute “do more enumeration.”
Session 3: turn a clue into a testable lead
Research one observed product or behavior. Prefer the original advisory, vendor documentation and relevant implementation details. Write the required version, platform, enabled component, access level and other conditions. Mark each as confirmed, contradicted or unknown.
Choose a next check that could change the decision. If an essential condition is contradicted, retire the lead. If the version is uncertain, validate that uncertainty rather than copying an exploit title into the plan.
Resume note: “Before testing lead [name], confirm [missing prerequisite] using [specific evidence or inspection].” See the service record guide for a suitable structure.
Session 4: validate one hypothesis and record the actual outcome
Recheck the starting snapshot, target identity and tool environment. Read any proposed test before using it, including its assumptions and effects on the VM. Keep the test within the intended exercise and preserve a recoverable state before changes.
Record success, failure or ambiguity exactly as observed. If access is obtained, distinguish the initial identity and permissions from later privileged access. If no access is obtained, write the blocker and its supporting evidence; this is still useful investigation output.
Resume note: “Observed [result] in [evidence ID]; [condition] remains untested.” Avoid “root achieved” or “exploit failed” unless the evidence establishes that statement.
Session 5: reproduce a claim, then write it clearly
Select a bounded claim from your evidence. Reconstruct the starting conditions and follow the recorded steps. If restoring a snapshot changes addresses, files or tool state, record the difference before comparing results.
Use the report template to explain conditions, actions, observations, interpretation, impact limits and remediation. Mark a proposed retest as a plan unless you actually performed it. Choose one specific gap for the next exercise.
Resume note: “Next, practise [skill] because [evidence of the gap].” A clean explanation is more useful than extending the report with unsupported claims.
How to use a short study block
- Read the last resume note and identify the starting state.
- Write one question and the condition under which you will stop.
- Do the smallest relevant inspection or test.
- Save output and separate observation from interpretation.
- Close with a snapshot reference, open question and precise next action.
Choose the duration that fits your schedule. If the question is larger than the available block, split it. Do not rush into a new test just because time remains, and do not keep repeating the same action solely to fill a planned session.
Use hints without losing track of independent work
Before opening a walkthrough, write what you observed, tried and still need to know. Read the smallest useful hint. Record the source and which decision it supplied. Later, replay that decision from your own notes and mark whether the explanation was reconstructed independently.
Use the Level 1 walkthrough as assistance when needed, with its environment assumptions in view. A successful assisted reproduction and an independent discovery are different learning outcomes; neither needs an inflated claim.
Copy this schedule into your notes
Planned block / date: Session or subtask: Starting snapshot and target identity: Question: Required evidence already available: One planned action: Stopping condition: Actual observation and evidence ID: Interpretation and remaining uncertainty: Hint or external assistance used: Changes to preserve or revert: Exact resume point:
Keep the detailed journal in lab notes. Revise the plan when prerequisites change. The useful measure is whether your evidence and reasoning can be resumed and reviewed, not whether the calendar has five check marks.