Use this Kioptrix decision review when a lab session has stopped producing useful evidence. The outcome is a written decision to continue, repair the environment, research one prerequisite, ask for help, or stop. For commands that fail, use the troubleshooting guide; for choosing between fresh leads, use the next-step selector.
Evidence status: this is an editorial worksheet with illustrative examples. No new VM execution, measured learning benefit or independently verified exploit result is claimed. Reviewed October 21, 2026.
First decide whether continuing is justified
| What you know | Decision | Evidence needed to resume |
|---|---|---|
| Target identity or authorization is unclear. | Stop testing. | Confirmed scope and current target identity. |
| The VM or network differs from your baseline. | Repair the environment. | Documented configuration and a repeatable baseline check. |
| A tool failed before the relevant check completed. | Diagnose the failure. | Exact sanitized error, tool version and failed stage. |
| You have a result but cannot explain what it means. | Research one interpretation. | A primary source and a statement of the result’s limits. |
| One small permitted check would distinguish two explanations. | Continue with that check. | Expected outcomes, stop condition and recovery plan. |
| You cannot state a useful next question. | Save the record and pause or request a hint. | A bounded question that changes a decision. |
These are workflow choices, not a diagnostic score. There is no universal time limit or fixed number of failures that proves you should pivot. Repeating the same command can be useful if a relevant condition changed; record that condition rather than repeating it without a reason.
A five-step review that leaves an auditable trail
- Freeze the current evidence. Save the command, timestamp, tool version, actual target and unedited output in your private lab notes. Make a sanitized copy for sharing. Do not replace earlier output with a cleaned summary.
- Name the last confirmed fact. “A response was received from the confirmed lab IP at this time” is narrower than “the service is vulnerable.” State the observation and its conditions.
- Separate the explanation from the observation. Write your preferred explanation and at least one plausible alternative. If you lack enough evidence even to form an alternative, name the missing information.
- Choose a distinguishing check. Ask what each possible result would change. If every result would lead you to the same action, reconsider whether that check is useful.
- Write the resume or stop condition. Name what must be true before proceeding. Save a recovery snapshot when appropriate, without overwriting evidence you still need.
Worked example: filtered does not mean closed
Illustrative example, not a captured Kioptrix result: a learner sees a port reported as filtered and concludes the service is not running. The observation only establishes how Nmap classified the probes from that vantage point under those options. It does not establish that nothing is listening.
The Nmap port-state reference distinguishes these states. Preserve the original classification instead of rewriting it as “closed.” In your own authorized lab, compare the recorded route and VM network with the baseline before selecting another test.
| Record field | Example entry |
|---|---|
| Observed | The saved scan labels the selected port filtered; the scan options and time are recorded. |
| Not established | Whether an application is listening; which rule or network condition affected the probes. |
| Next check | Compare the current virtual network and route with the last documented working baseline. |
| Resume condition | Target identity and network path are confirmed; the next permitted check answers a specific remaining question. |
When to ask for help or use a hint
A useful help request includes the release, host architecture, hypervisor, network mode, exact sanitized error, last confirmed fact and the one question you need answered. Do not share credentials, private keys or unrelated network data. It is reasonable to use a hint whenever it supports your learning; record what help you used.
If you consult the Level 1 walkthrough, compare its assumptions with your image and observed services. Do not present a copied path as your independently reproduced result. Once you resume, return to the roadmap rather than opening another general motivation article.
Build your pause-and-resume record
This worksheet generates text in this page only. It does not submit the fields or automatically save them. Reloading clears the entries. Use sanitized lab notes and copy or download the output before leaving.
References and next task
NIST SP 800-115 covers planning, technical testing and analysis; Nmap’s port-state reference explains the example’s terminology. The decision table and worksheet are this site’s editorial learning aids, not an official NIST procedure.
Next: use the next-step selector to choose a test, or turn the completed review into a lab report. Read the author and evidence policy.