Project 99: Zero-Day Research Methodology

Module: Module 10: Advanced Detection Engineering & Zero-Day Research  |  Level: Advanced  | 
Primary tool: NVD (nvd.nist.gov, free) + a documented CVE  |  Estimated time: 2–4 hours

Objective: Learn the disciplined research and responsible-disclosure workflow around vulnerability discovery.

Free lab environment

Metasploitable2 (free vulnerable VM) + Greenbone/OpenVAS Community Edition — https://sourceforge.net/projects/metasploitable/ and https://www.greenbone.net/en/community-edition/

Metasploitable2 is a free, intentionally vulnerable Linux VM published by Rapid7 specifically for this kind of training; download it, run it in NAT-less/host-only mode in VirtualBox so it is not exposed to your real network, and treat it as your scan target. Greenbone’s Community Edition of OpenVAS is free and open-source.

Lab workflow

1. Stand up your target (a historical, already-patched CVE you research (never undisclosed research on live software)) in an isolated host-only VM network.
2. Run NVD (nvd.nist.gov, free) + a documented CVE with the specific goal of learning to learn the disciplined research and responsible-disclosure workflow around vulnerability discovery.
3. Before writing anything, sort your raw findings by severity so your report reflects real priority, not the order the tool happened to list them in.
4. For your top 3 findings, write: what it is, how you confirmed it, the real-world risk, and the fix.
5. If time allows, apply at least one fix and re-scan to confirm it’s resolved.
6. Assemble your findings into the deliverable format described below.

Evidence & screenshot requirements

Submit the following with your report (see this module’s practical assignment for exact upload details):

• your written case-study analysis of a chosen CVE: root cause, discovery method, and disclosure timeline
• your written summary of a responsible-disclosure policy and why coordinated disclosure matters

Expected deliverable

A concise lab-report entry containing: scope/target, exact commands or payloads used, your key
observation, the required screenshots above, and — where applicable — the specific remediation for what
you found. Vague answers (“sanitize input”, “use a firewall”) without naming the exact mechanism will not
receive full credit.

Safety & authorization

Only test the specific free lab target named above, or infrastructure you personally own. Do not target
third-party systems, real user accounts, or production services without explicit written authorization.
Never deploy anything from this project outside an isolated lab environment.