Vulnerability Discovery

Windows vulnerability discovery is about finding the weaknesses in a Windows host that lead to privilege escalation, lateral movement, or data access. Missing patches are the obvious starting point. systeminfo output compared against known exploits (Windows Exploit Suggester, watson, Sherlock) quickly identifies kernel-level and service-level CVEs.

Beyond patching, look for misconfigured services with weak DACLs (accesschk, sc sdshow), unquoted service paths in directories where you can write, exploitable privileges like SeImpersonate, and scheduled tasks or startup scripts running from writable locations. Registry permissions, always-install-elevated policies, and stored credential entries all represent exploitable findings.

The subpages walk through systematic discovery using both manual commands and automated tools (winPEAS, PowerUp, BeRoot), explaining what each check looks for and how to evaluate whether a finding is actually exploitable in the target environment.