<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-red-team-validation-of-findings
description: >-
  Validate vulnerability scanner findings through targeted red team exploitation
  to confirm exploitability, assess real-world impact, identify false positives,
  and prioritize remediation by demonstrated risk.
domain: cybersecurity
subdomain: vulnerability-management
tags:
  - red-team
  - exploitation-validation
  - penetration-testing
  - metasploit
  - nuclei
  - proof-of-concept
  - false-positive-validation
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1190"]
---

# Performing Red Team Validation of Findings

## Overview

Scanners produce findings; red teams prove exploitability. Validation bridges the
gap between theoretical vulnerability (CVSS score) and demonstrated impact (actual
exploitation). This skill covers targeted validation of scanner findings using
Metasploit, nuclei, manual exploitation, and custom PoC development to confirm
true positives, eliminate false positives, and assess real business impact.

Mode: `[MODE: RED]` — Offensive validation with `[MODE: PURPLE]` detection mapping.

## Prerequisites

| Requirement | Details |
|---|---|
| Authorization | Signed rules of engagement (RoE) and scope document |
| Metasploit Framework or Cobalt Strike | Required |
| nuclei with vulnerability templates | Required |
| Python 3.10+ with `requests` | Required |
| Isolated testing environment or production approval | Required |
| Evidence collection tools (screenshot, pcap, logs) | Required |

## Key Concepts

### Validation Methodology

```
For each scanner finding:
1. REVIEW — Understand the CVE, affected version, exploit requirements
2. VERIFY — Confirm vulnerable version/configuration exists on target
3. EXPLOIT — Attempt controlled exploitation (safe payloads first)
4. IMPACT — Assess actual impact (data access, code execution, lateral)
5. DOCUMENT — Evidence chain: screenshot, command output, network capture
6. DETECT — Document detection opportunities for blue team
```

### Nuclei Validation

```bash
# Validate specific CVEs from scanner output
nuclei -l /tmp/targets.txt \
  -t cves/2024/CVE-2024-6387.yaml \
  -severity critical,high \
  -json -o /tmp/nuclei_validation.json

# Validate with multiple CVE templates
nuclei -l /tmp/targets.txt \
  -t cves/ \
  -id CVE-2024-6387,CVE-2021-44228,CVE-2023-44487 \
  -json -o /tmp/multi_validation.json

# Validate exposed panels and misconfigurations
nuclei -l /tmp/targets.txt \
  -t exposures/ -t misconfigurations/ \
  -severity critical,high \
  -json -o /tmp/exposure_validation.json

# Validate with custom rate limiting (safe for production)
nuclei -l /tmp/targets.txt \
  -t cves/ \
  -rate-limit 10 \
  -bulk-size 5 \
  -concurrency 2 \
  -json -o /tmp/safe_validation.json
```

### Metasploit Validation

```bash
# Validate SSH vulnerability (CVE-2024-6387)
msfconsole -q -x "
  use auxiliary/scanner/ssh/ssh_version;
  set RHOSTS file:/tmp/ssh_targets.txt;
  run;
  exit
"

# Validate SMB vulnerabilities
msfconsole -q -x "
  use auxiliary/scanner/smb/smb_ms17_010;
  set RHOSTS file:/tmp/smb_targets.txt;
  run;
  exit
"

# Validate web application findings
msfconsole -q -x "
  use auxiliary/scanner/http/apache_log4j;
  set RHOSTS file:/tmp/web_targets.txt;
  set RPORT 8080;
  run;
  exit
"

# Resource script for batch validation
cat > /tmp/validate.rc << 'EOF'
use auxiliary/scanner/ssh/ssh_version
set RHOSTS file:/tmp/targets.txt
set THREADS 5
run
use auxiliary/scanner/smb/smb_ms17_010
set RHOSTS file:/tmp/targets.txt
run
EOF
msfconsole -q -r /tmp/validate.rc
```

### Evidence Collection

```bash
# Capture network traffic during validation
tcpdump -i eth0 -w /tmp/validation_pcap.pcap host TARGET_IP &

# Screenshot evidence (web findings)
chromium --headless --screenshot=/tmp/evidence.png "https://target/vulnerable_page"

# Log all commands with timestamps
script -t /tmp/timing.log /tmp/validation_session.log
```

### Detection Opportunity Mapping

```
Every validated finding includes detection guidance:

[FINDING] CVE-2024-6387 — OpenSSH regreSSHion validated
├── EXPLOITATION: Confirmed RCE on target host
├── DETECTION: SSH auth failure spike in /var/log/auth.log
│   ├── Sigma: net_connection_sshd_exploit_pattern
│   ├── Suricata: alert tcp any any -> any 22 (content:"SSH-2.0"; sid:1000001;)
│   └── EDR: Process tree anomaly — sshd spawning unexpected child
├── NETWORK: Connection burst pattern on port 22 (>100 connections/minute)
└── RECOMMENDATION: Patch to OpenSSH 9.3p2+ OR block at network layer
```

## Workflow

### Step 1: Import Scanner Findings

```bash
node scripts/agent.js --action import \
  --input /tmp/scanner_findings.json \
  --output /tmp/validation_queue.json
```

### Step 2: Run Automated Validation

```bash
node scripts/agent.js --action validate \
  --input /tmp/validation_queue.json \
  --output /tmp/validation_results.json
```

### Step 3: Generate Validation Report

```bash
node scripts/agent.js --action report \
  --input /tmp/validation_results.json \
  --output /tmp/validation_report.json
```

### Step 4: Review Confirmed vs False Positives

```bash
cat /tmp/validation_report.json | \
  jq '.findings[] | {cve, status: .validation_status, impact: .demonstrated_impact}'
```

## Detection

```yaml
title: Red Team Validation Of Findings Detection
id: d2c743dd-5a62-4d19-ba20-ae02e8700271
status: experimental
description: Detects suspicious activity related to performing red team validation of findings techniques in vulnerability management context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*performing*red*"
  condition: selection
level: medium
tags:
  - attack.t1190
  - attack.discovery
falsepositives:
  - Vulnerability scanner performing scheduled assessment scans
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Red Team Validation Of Findings Detection | windows/process_creation | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1190 |

## Verification

- [ ] Rules of engagement signed and scope validated
- [ ] All critical/high findings validated within SLA
- [ ] False positive rate documented and fed back to scanner tuning
- [ ] Evidence chain preserved for each validated finding
- [ ] Detection opportunities documented for blue team
- [ ] Validation results integrated into vulnerability priority rankings
- [ ] Safe exploitation techniques used (no destructive payloads)

## References

- [PTES — Penetration Testing Execution Standard](http://www.pentest-standard.org/)
- [MITRE ATT&CK — Techniques](https://attack.mitre.org/techniques/enterprise/)
- [ProjectDiscovery nuclei Templates](https://github.com/projectdiscovery/nuclei-templates)
- [Metasploit Framework Documentation](https://docs.metasploit.com/)
- [OWASP Testing Guide v4.2](https://owasp.org/www-project-web-security-testing-guide/)
