10 · Project — Full Penetration Test Report¶

This capstone project brings together every Level 3 skill — advanced pentesting chains, forensics-grade documentation habits, malware and threat intelligence awareness, and compliance-ready reporting — into a single deliverable: a professional penetration test report against your own lab.

Authorized lab only

Run this entire exercise against infrastructure you own: a local multi-VM lab (Metasploitable2, a deliberately misconfigured web app like DVWA/Juice Shop, and a Windows VM), or a HackTheBox/TryHackMe environment explicitly licensed for this kind of testing. Never perform any part of this against systems you don't have explicit written authorization to test.

1. Project scope¶

Build a lab of at least three targets representing different attack surfaces, then run a complete engagement, end to end, exactly as a professional pentest is scoped, executed, and reported:

Target 1: A vulnerable web app (Juice Shop or DVWA) -- web app testing
Target 2: Metasploitable2 or similar -- network/service exploitation
Target 3: A Windows VM (join a small lab AD domain if possible) --
          Windows/AD-specific testing

2. Phase 1 — Scoping and rules of engagement¶

Write a one-page RoE document, exactly as you would for a real client:

Engagement: Internal Lab Penetration Test
Scope: 192.168.56.0/24 (lab network only)
Objectives: Identify and chain vulnerabilities to demonstrate realistic
  business impact; assess detection capability if a SIEM/logging is present
Excluded: Denial-of-service testing, destructive actions
Testing window: [dates]
Authorization: self-authorized, personal lab environment

3. Phase 2 — Reconnaissance and enumeration¶

Apply Level 2 Module 9's methodology and Level 3 Module 1's chaining mindset:

nmap -sC -sV -oA recon/full-scan 192.168.56.0/24
gobuster dir -u http://192.168.56.101 -w /usr/share/wordlists/dirb/common.txt
nikto -h http://192.168.56.101

Document every finding as you go — screenshots, command output, and timestamps — this becomes your evidence appendix later.

4. Phase 3 — Exploitation and chaining¶

Gain initial access on at least one target, then apply Module 1's privilege escalation and lateral movement techniques to build a real attack chain rather than stopping at first foothold:

# Example chain skeleton to fill in with your actual lab findings
1. Initial access:    <vulnerability + exploit used>
2. Privilege escalation: <technique, e.g. SUID binary / cron job>
3. Credential harvest:  <where found>
4. Lateral movement:   <second host reached, how>
5. Final objective:    <e.g. domain admin / access to a "sensitive" file>

5. Phase 4 — Detection assessment (blue team lens)¶

If you set up logging/a SIEM in Level 2-3, check what your own attack would have triggered — apply Module 8's purple team thinking to your own work:

Step 1 (recon):        Detected? [ ] Yes [ ] No -- evidence:
Step 2 (exploitation):  Detected? [ ] Yes [ ] No -- evidence:
Step 3 (persistence):   Detected? [ ] Yes [ ] No -- evidence:

6. Phase 5 — Writing the report¶

A professional report has these sections, in this order:

1. Executive Summary       -- 1 page, non-technical, business risk framed
2. Scope and Methodology   -- what was tested, how, tools used
3. Risk Summary Table      -- findings by severity (Critical/High/Med/Low)
4. Detailed Findings       -- one per finding: description, evidence,
                               CVSS score, business impact, remediation
5. Attack Narrative        -- the full chain, as in Module 1's format
6. Detection Assessment    -- what would/wouldn't have been caught
7. Remediation Roadmap     -- prioritized, with effort estimates
8. Appendices              -- raw scan output, screenshots, tool versions

Example finding entry:

Finding: SQL Injection in Login Form (Critical)
CVSS 3.1: 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Location: POST /login, parameter 'username'
Evidence: [screenshot of authentication bypass via ' OR '1'='1]
Business Impact: Full authentication bypass; combined with the privilege
  escalation in Finding #3, leads to complete database compromise
Remediation: Use parameterized queries/prepared statements exclusively;
  never build SQL via string concatenation with user input (Level 2
  Module 7)

7. Executive summary framing¶

The executive summary is what leadership actually reads — write it in business terms first, technical terms second:

During this assessment, testers achieved full administrative control
over [system] within [N hours], starting from a publicly-exposed web
form with no authentication required. This demonstrates that an external
attacker with no prior access could achieve [business impact, e.g.
"access to all customer records"] using only publicly documented
techniques. Three findings, if remediated, would have broken this chain
at any point.

8. Deliverable checklist¶

[ ] RoE written and dated before testing began
[ ] At least three distinct targets tested (web, network, Windows/AD)
[ ] A real, multi-step attack chain demonstrated, not just isolated findings
[ ] Every finding includes evidence, CVSS score, and specific remediation
[ ] Executive summary written for a non-technical audience
[ ] Detection assessment included, mapped to what logging exists
[ ] Report reviewed for clarity by someone unfamiliar with the lab setup

What's next¶

Level 4 shifts from individual technical assessments to designing and leading security programs at an organizational scale.