Overview

Initial access is converting reconnaissance into a foothold. It's the first deliberate act of compromise and should be shaped entirely by the intelligence gathered during reconnaissance.

Strategic context

Initial access is not about running every available exploit. It's about selecting the approach that best balances reliability, stealth, and positioning for the next phase. Your choice of initial access method determines the quality of the foothold and shapes the rest of the operation.

Effective initial access starts with understanding what was discovered during reconnaissance. Exposed services, unpatched applications, weak password policies, and misconfigured authentication are all potential entry points that need to be evaluated against operational objectives.

For security leaders, initial access is where exposure becomes compromise. The gap between a system being reachable and a system being exploitable is often narrower than expected. Understanding how attackers select and execute initial access helps prioritize what needs immediate attention.

Categories of initial access

This manual organizes initial access into three categories. Each represents a different type of opportunity and requires a different mindset.

Public exploits

When reconnaissance identifies a service running a vulnerable version, public exploits provide a proven path to access. But beware, finding exploits is easy, but it takes some experience to evaluatie whether the exploit is reliable, appropriate for the engagement, and has low risk of causing disruption.

Web application attacks

Web applications are frequently the largest externally exposed attack surface. Vulnerabilities in input handling, authentication, and session management provide some of the most common initial access paths. Web application attacks often require more manual effort than running a public exploit, but they also tend to be more reliable and targeted.

Password attacks

Weak passwords, credential reuse, and exposed authentication services create opportunities for credential-based initial access. These attacks are informed by the username enumeration conducted during reconnaissance.

Common mistakes

• Attempting exploitation without understaning risk

• Using noisy or unreliable exploits

• Failing to validate exploit behavior before using it against a production target

• Not planning for what happens after access is achieved

Operator notes

• Let reconnaissance drive the selection of the initial access method

• Validate exploit reliability in a controlled environment when possible

• Plan for post-access activity before executing. Know what you will do once access is gained

• Document as you go, accurate reporting depends on it.