Once we've reached a clear end to the recon phase, the next is always to research and test possible exploit pathways.