Kioptrix Decision Tree: Yes, No and Unknown Branches

Build a Kioptrix decision tree around a question that an observation can answer. Use yes, no and unknown branches. A timeout, incomplete check or ambiguous response should remain unknown until you have evidence for a narrower conclusion.

Start with the prerequisites

Keep the image, target identity, network boundary and current state available. If you cannot identify the intended guest, return to the setup checks. If you have an exact execution error, use symptom-based troubleshooting before interpreting the missing result.

This tree is for selecting one next observation. It is not an exhaustive attack path, severity calculator or guarantee that a shell exists.

Use the branch that matches your evidence

Choose a check, not a presumed conclusion

Question	Yes	No	Unknown
Is the current target identified?	Use that identity for the next permitted check.	Correct the target selection.	Recheck the guest MAC, address and boundary.
Did the action finish with relevant coverage?	Interpret the recorded result.	Diagnose the incomplete action.	Inspect completion status and tool options.
Does the application return observable content?	Record the response and choose a content question.	Record the actual error or response.	Separate connectivity, hostname and application state.
Are the advisory prerequisites established?	Plan a permitted validation with a stop condition.	Park the mismatched lead.	Research the missing build or configuration fact.

Worked branch: an application hostname

Illustrative example, not a tested Kioptrix result. A lab page mentions a hostname. The question is whether the browser machine resolves it to the confirmed target address.

1. Yes: save that mapping and inspect the permitted HTTP response using the hostname. Record redirects and the access context.
2. No: review the intended local lab mapping. Do not browse or scan an unrelated destination just because the name resolves there.
3. Unknown: if the target address itself is unverified, return to identity evidence. Do not choose the yes branch using a guessed address.

Keep hostname resolution, application response and vulnerability applicability as separate questions. One successful connection answers only part of the chain.

Attach a record to every branch

Node question:
Evidence and conditions:
Yes: supported next check:
No: supported next check:
Unknown: missing observation:
Expected distinction and stop condition:
Actual result and artifact ID:
Why a parked branch might be revisited:

Prefer a check whose possible outcomes change your next decision. Repeating a broad scan without a new question may reproduce the same uncertainty. For tool capability comparisons use the tool-selection guide.

Know when to stop or ask for help

Stop active testing if the target, permission or boundary becomes uncertain. Pause a branch if its prerequisites are unavailable or the next action exceeds your recovery plan. A focused help request can include a sanitized error, relevant conditions and the specific distinction you cannot make.

There is no mandatory struggle period, minimum number of tools or required route to root. Record hints and copied steps as assistance. Preserve the original result when later evidence changes your interpretation.

Sources and scope

The Nmap reference distinguishes scan behavior and reported states. NIST SP 800-115 provides assessment-planning context. The three-way tree is an editorial aid for your authorized lab; it is not a validated success-probability model.

Editorial revision: October 25, 2026. Replaced repetitive introductions with a task-specific workflow, comparison and illustrative example. No new VM execution, measured learning effect or hiring outcome is claimed. Author and evidence policy.

Working note: Keep an inconclusive branch in the decision tree

Replace the prompts with your own authorized lab evidence. Select the completed text and copy it to a local note before leaving. This field is not submitted or saved; reload clears edits. Do not enter passwords, tokens or personal data.

Editable task recordDecision question: [Unresolved] Evidence for each branch: [Unresolved] Unknown branch and missing observation: [Unresolved] Stop and revisit conditions: [Unresolved]

Related task: Continue with the related practical guide.