Question

During an authorized web application assessment, you identify a WordPress site running a plugin that matches a known RCE CVE. You load the corresponding Metasploit exploit module and want to safely determine whether the target is actually vulnerable before firing the exploit, minimizing the chance of crashing the production service. What is the most appropriate next step?

Accepted Answer

Run the module's 'check' command to validate exploitability without delivering the full payload

Answer

Set PAYLOAD to a Meterpreter reverse shell and run 'exploit' immediately to confirm the finding

Answer

Increase the module's brute-force thread count to speed up target verification

Answer

Disable the target's WAF using an auxiliary DoS module before running the exploit