I'm following a course where the trainer recommends to identify all the vulnerabilities affecting a web application before trying to exploit them.
While I understand the need to identify all the vulnerabilities, I don't understand why I should wait before trying to exploit a vulnerability I just found (like a sql injection, a command injection, remote file inclusion, ...) and come back to it later?
Is there any reason to proceed like that?

3 Answers 3


There's a chance that the result of exploiting a vulnerability early in the test could change the application. Either crashing it or just breaking certain functionality. Thus making the need to scan for additional vulnerabilities moot.

Another reason for thoroughly identifying vulnerabilities is to give the person performing the test a full understanding of the application. Perhaps that first vulnerability could be exploited even further with information gained in the later stages of the vulnerability assessment.

  • 2
    Maybe another point, is to not spend too much time on exploitation of a vulnerability and taking the risk of not testing the other vulnerabilities since we've limited time?
    – Othman
    Jun 11, 2016 at 4:18
  • @Othman Great point! +1 Jun 11, 2016 at 4:19
  • 1
    Exactly. First fully observe a system before starting to make (unwanted) changes to it. Exploits could also trigger defensive mechanisms and hide other vulnerabilities.
    – Potaito
    Aug 10, 2016 at 6:24
  • 1
    If this course is anything like the ones I've seen and taken, @potAito is probably onto something. When learning methodologies (as compared to say, trying to maliciously compromise a system) thoroughness is valued because the primary expected output is an analysis (as opposed to an successful exploit). It sounds as though this instructor is attempting to help you develop the skills to perform a complete audit as the first objective and in that case it makes sense to run through the entire application (and associated stack components) to produce an inventory. Aug 28, 2016 at 4:50

That sounds more like a course in how to hack someone else's site than to test yours.

Following the suggested logic allows the perpetrator to better plan a quick attack that will let them gain control of the machine before anyone has time to notice the attempts.

That provides no benefit for someone who is only testing their own system's security.

  • Well, penetration testing and hacking do require identical tools and skills. Otherwise the testing would be pointless.
    – Potaito
    Aug 10, 2016 at 5:46
  • 1
    My point was that it makes no sense to try to avoid your own vigilance. Aug 10, 2016 at 6:05

If you keep looking you may find an easier to exploit vulnerability or one that gives you more privilege. Of course, if you first find an easy to exploit remote code execution vulnerability there's really no need to look for more.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .