How we run a pentest

The engagement spine

1. 1 · Pre-engagement and scope

   Nothing starts until the scope is locked. Targets, windows, excluded systems and the rules of engagement are agreed before a single packet (simulated or otherwise) is sent.

   • Define in-scope ranges, hosts and cloud accounts — and what is explicitly out
   • Set the testing window and any no-go actions (no DoS, no exfil of real data)
   • Record it all on the engagement so the range can flag scope violations for you

   External Recon to Footholdpt-01-external-recon-to-foothold

2. 2 · Reconnaissance and enumeration

   Map the attack surface from the authorized vantage point: port and version scans, web content discovery, directory and role enumeration. Output is a target list, not a finding list.

   • nmap SYN + version scans against only the approved range
   • gobuster / ffuf content discovery on in-scope web surface
   • Directory and cloud role enumeration to feed the attack graph

   External Recon to Footholdpt-01-external-recon-to-footholdCloud Privilege Escalationpt-04-cloud-privesc

3. 3 · Exploitation and initial access

   Prove the risk with the least force necessary. One supervised exploit against a stale service, one phish against an authorized audience, one crack of a captured handshake — then stop and document.

   • Exploit only what the ROE names, under supervision
   • Capture proof (session, screenshot-equivalent, loot record) at the moment of access
   • Note every defensive gap you notice — the blue mirror is watching too

   Web App Assessment (OWASP Top 10)pt-03-web-app-assessmentWireless Assessmentpt-06-wireless-assessmentAuthorized Phishing Simulationpt-07-phishing-simulation

4. 4 · Post-exploitation and lateral movement

   From the foothold, answer the question the customer actually asked: how far could this go? Read the attack graph before you move, walk the shortest path, and record every hop.

   • Read /pentest/attack-graph before touching credentials
   • Kerberoast, DCSync and AssumeRole chains executed deliberately, one hop at a time
   • Track beacons, tasks and loot in the C2 console, scoped to the range or scenario

   Read the AD Attack Graphpt-02-ad-attack-graphCloud Privilege Escalationpt-04-cloud-privescPurple-Team Emulationpt-05-purple-team-emulationDefense Evasion and EDR Sidesteppt-08-defense-evasionC2 Operations and Tunnelingpt-09-c2-operations-and-tunnelingRansomware Adversary Emulationpt-10-ransomware-emulation

5. 5 · Reporting and handover

   The deliverable is the product. Every finding carries a CVSS 3.1 vector, evidence, and a remediation a real engineer can action. The engagement exports as a report, not a memory.

   • File each finding as you go — score, evidence, remediation — never at the end
   • Tag web findings with their OWASP Top 10 category
   • Export the report from the engagement and walk the customer through it

   External Recon to Footholdpt-01-external-recon-to-footholdRead the AD Attack Graphpt-02-ad-attack-graphWeb App Assessment (OWASP Top 10)pt-03-web-app-assessmentCloud Privilege Escalationpt-04-cloud-privescPurple-Team Emulationpt-05-purple-team-emulationWireless Assessmentpt-06-wireless-assessmentAuthorized Phishing Simulationpt-07-phishing-simulationDefense Evasion and EDR Sidesteppt-08-defense-evasionC2 Operations and Tunnelingpt-09-c2-operations-and-tunnelingRansomware Adversary Emulationpt-10-ransomware-emulation