Confirming findings

Confirmation takes a completed discovery run and safely proves which of its candidate findings are genuinely exploitable, upgrading them to confirmed with proof-of-concept evidence. It is available on self-hosted deployments.

Check eligibility

Open a completed discovery run. When the run can be taken further, the header shows a Launch Exploitation button with the number of exploitable findings. If it cannot, the button is disabled and its tooltip explains why.

Launch a confirmation run

Launching exploitation is an analyst action.

1. Select Launch Exploitation.
2. Choose an exploitation template. Only templates that fit this run’s findings are listed.
3. Select Launch Exploitation.

A confirmation run works against all exploitable findings from the source run. To narrow the scope, mark findings as false positive or accepted risk before launching, and those are skipped. See Findings and reports.

You can also start from a project’s Templates tab: pick an exploitation template, then choose the completed discovery run to work from.

Follow it and read the results

A confirmation run uses the same live view as any run, with agents such as Web Exploitation, Network Exploitation, Credential Attack, and Privilege Escalation.

When it finishes, the Summary tab shows how many findings were tested, how many were confirmed, how many were not exploitable, and a confirm rate. Confirmed findings carry a proof of concept and the impact demonstrated, and they show a Verified badge. The matching finding on the original discovery run is upgraded to Confirmed.

Safe by design

Confirmation demonstrates impact as proof of concept only. It does not run destructive payloads, exfiltrate data beyond what proves the point, leave anything behind, or move beyond the target. See Safe exploitation.

Next

• Findings and reports: read confirmed findings and their evidence.
• Safe exploitation: the safety envelope in full.