Use this Kioptrix self-assessment to review one specific task: what you can explain, what the evidence establishes, which help you used, and what you need to practise next. You do not need to finish the VM or obtain root access to make a useful record.
This is an editorial learning worksheet, not a validated skill test, certification score or employment assessment. Examples are illustrative. No new VM execution or measured learning benefit is claimed.
Choose a task with a clear evidence boundary
Start with a question such as “Can I explain how this address was matched to the intended target VM?” or “Can I explain the coverage of this saved scan?” These are more useful review targets than “Am I good at cybersecurity?”
Record the image, host architecture, hypervisor, snapshot, network, tool version, exact action and relevant evidence files. Only include conditions that matter to the task, but keep changes visible. If target identity or permission is uncertain, stop active testing and return to setup checks.
This worksheet can be used by a beginner with an unfinished investigation or by someone revisiting an old lab. Choose a task you can inspect from saved evidence. If the main blocker is Linux navigation or networking, use the beginner roadmap to practise that foundation separately.
Review four criteria without assigning an overall score
For each criterion, use explained, needs help or not yet checked. Attach a short explanation and an evidence reference. These are your working labels; selecting one does not verify a skill.
| Criterion | Question to answer | Useful supporting record |
|---|---|---|
| Inputs and coverage | What was tested, using which options and starting conditions? | Exact action, version, scope and completion status. |
| Observation and interpretation | What actually happened, and what do you infer from it? | Literal response or faithful excerpt, original file reference and a separate interpretation. |
| Limitations | Which explanation or prerequisite remains unresolved? | Coverage gaps, alternatives and a condition the evidence does not establish. |
| Reproduction | Could the observation be repeated from the recorded state? | Starting conditions and steps; mark a replay not performed until it actually happens. |
Use needs help when you can name the gap but cannot yet explain it. Use not yet checked when you have not assessed that criterion. Missing evidence stays unresolved; it should not become a passing result or a failing grade by default.
A command count, an elapsed time or a 1–5 rating does not establish general competence. Time may be recorded as context. If a later attempt is faster, also record remembered steps, assistance and environment changes before making a comparison.
Keep assistance separate from verification
Record where the approach came from: your own reasoning, primary documentation, a hint, a walkthrough, a person or another tool. Also record which observation you actually collected. The source of an idea and the evidence supporting a claim answer different questions.
- A walkthrough can supply an idea that you later test carefully.
- An original hypothesis can remain untested.
- A copied command can produce output you have not yet learned to interpret.
- A remembered route can help you reproduce a result without demonstrating a new independent discovery.
There is no required waiting period before using a hint. If you want to review independent reasoning, save your question and current evidence before consulting assistance. Then record what the help changed. Guided learning is useful when its role is described accurately.
Worked example: real output, one unresolved option
Illustrative example only: suppose you ran a supplied scan command in your authorized lab and saved its output, but cannot explain why those ports were selected. This page does not claim that such a scan was performed.
Your record might say: “Approach supplied by [source]. Output stored as [evidence ID]. I can locate the recorded responses, but need help explaining port selection and the limits of coverage. I have not repeated the check from a clean baseline.”
The saved output and your understanding of its options are separate review items. Choose one next task: consult the Nmap flag reference and explain that option in your own words. If another authorized check is needed, define its scope and expected observation first. Keep the earlier note rather than rewriting it to imply you understood the option from the start.
End with one reviewable next practice task
- Preserve the original. Keep the action, timestamp, output and assistance source in your private session notes.
- Name one gap. State whether the missing item is an explanation, an observation, a prerequisite or an unperformed replay.
- Choose a bounded next action. Write which result would change your conclusion, and when you will pause.
- Add a dated follow-up. Record what actually changed, including unsuccessful or inconclusive checks.
An unsuccessful action can still preserve useful evidence. It does not automatically rule out a vulnerability or establish why the action failed. Classify the observed stage and retain unresolved explanations. Use troubleshooting for a specific error or the pause-and-resume worksheet when the next action is unclear.
Repeat a task when you have a specific question about your explanation or reproduction. There is no fixed number of repeats or session duration here. For comparing two attempts, use the progress comparison guide and identify changed conditions.
Describe the learning project within its actual limits
If you share this work in a portfolio or interview, identify it as an intentionally vulnerable training lab. Describe the task, your actual contribution, the evidence, assistance used and remaining uncertainty. An unfinished investigation can be presented accurately; do not invent client work, independently discovered access or a successful retest.
The NICE Framework Resource Center describes cybersecurity work and associated knowledge and skills. It is broader career and education context, not a Kioptrix grading scheme or approval of this worksheet.
Write your assistance-aware task review
Replace the prompts with sanitized evidence from your own lab. Copy or download the current record before leaving. Entries are not submitted or automatically saved; reloading clears edits. Do not enter passwords, tokens or personal data.
Frequently asked questions
Do I need root access before reviewing my work?
No. Review a specific task and its actual evidence, including a blocked or incomplete task. Root access alone would not explain your reasoning or establish the scope of your understanding.
Does using a walkthrough invalidate the evidence?
No. Disclose the assistance and distinguish a supplied approach from the observation you collected. Do not present an assisted reproduction as an independent discovery.
How can I separate improvement from memory?
Compare explanations and conditions, disclose remembered steps, and choose another authorized task when you want to practise applying the idea elsewhere. One successful repeat does not establish general transfer.
Does this worksheet validate my assessment?
No. It organizes your own statements. Review the original evidence and leave missing information unresolved. The download copies the text currently in the field.
References and scope
NIST SP 800-115: Technical Guide to Information Security Testing and Assessment provides background on planning technical testing, analyzing findings and mitigation. The review labels and examples here are this site’s editorial aids, not an official NIST, CISA or OWASP Kioptrix assessment.
Read the author and evidence policy. Editorial review: October 23, 2026. No new VM execution is claimed.