Lion Cipher Lab
Estimate how many findings two testers both missed with capture-recapture
- Penetration Testing / Red Team
- Intermediate
- ~40 min
- Free · no account required
Why it matters
Every penetration test ends with the question nobody can answer directly: how much did we miss? Coverage against scope tells you what was touched, not what was found. Ecologists counting fish in a lake face the same problem and solved it decades ago with capture-recapture. You catch and mark some fish, catch again later, and the share of marked fish in the second catch tells you roughly how many fish there are. Software engineering borrowed the idea: Eick and colleagues (ICSE 1992) used it to estimate how many faults design reviewers had not found, from how much their independent findings…
What you'll learn
- normalising two testers' findings so overlaps can be counted
- the Lincoln-Petersen idea and the Chapman estimator
- estimating findings nobody found, with an interval
- why a small overlap means a large, uncertain estimate
- the assumptions that make the estimate too low in practice
- using the result to decide whether more testing is needed
Steps in this lab
- Two independent catches tell you about the whole pond
- Two engagements, two testers each
- Write the estimator
- Run it: one app well covered, one not
- Why it is usually an underestimate, and how to use it anyway