Do the Dumb Thing First
This phrase was hammered into my head during an uncharacteristically interesting AI class during college (I later dropped the class, my hats off to those of you who enjoy writing search algorithms all day, I’ll never compete with you for a job), and it’s something that I remind myself of constantly when doing assessments. Much of the work of attacking systems is doing the dumb thing first, a burglar wouldn’t bother to kick in a door without seeing if it’s unlocked first and neither would a hacker. As exciting as vulnerability research is, the truth is that systems usually aren’t compromised by using 0day, and most vulnerabilities aren’t going to be exploited until someone has put it in an easy to use tool.