Which stage of the cyberattack lifecycle involves querying public databases and testing exploits in the attacker's internal network?

Reconnaissance focuses on gathering information about the target's external posture and systems, not typically testing exploits in an internal lab or querying databases for *specific* exploits.

Weaponization involves packaging an exploit with a malicious payload, often requiring research into target vulnerabilities by querying public databases (e.g., CVEs) and testing the effectiveness of the exploit in a controlled environment (attacker's internal network) before delivering it to the target.

Exploitation is the act of successfully compromising the target system, not the preparatory work of testing exploits.

Installation is about establishing persistence on the compromised system, which comes after exploitation and successful delivery.