Deliver a full engagement from foothold to signed-off report

capstone · 180 min · Objective 5.2

Task

Run a whole engagement against your own lab, from first foothold to a delivered report a client could act on: exploit, pivot, document as you go, restore everything, write the attack narrative, and produce remediation negotiated to dated commitments. This is the entire course in one deliverable, unguided.

Steps

  1. On the lab you own, build a small multi-segment environment with a handful of real weaknesses, and write the scope and authorisation for it first — you are the client and the tester.
  2. Gain a foothold, escalate, move laterally, and pivot to a target only the deepest host can see — keeping an activity log and a cleanup list throughout.
  3. Prove each finding read-only where possible, capturing evidence and masking values.
  4. Restore every host from the cleanup list and confirm each matches its pre-engagement snapshot, keeping the activity logs.
  5. Write the report in /tmp/engagement/: executive summary, findings in full shape, the attack narrative showing the chain, coverage, and remediation negotiated to owners, dates and interim mitigations.
  6. Read the whole set for internal consistency: every asset in the report is in scope, nothing tested was out of scope, and the cleanup left nothing behind.

Verify

ls /tmp/engagement/ | grep -cE "\.md$"
grep -cE "^###\s+Finding" /tmp/engagement/report.md
grep -ciE "executive summary|coverage|narrative" /tmp/engagement/report.md
grep -cE "REDACTED|\*{3,}|<masked>" /tmp/engagement/report.md
grep -cE "^(owner|agreed date):" /tmp/engagement/remediation.md

The first count must be at least 3 — the engagement's artifacts. The second at least 3 — findings in full shape. The third and fourth non-zero — the report has its summary, coverage and narrative, and evidence is masked. The fifth non-zero — remediation reaches owners and dates. Then read across the set yourself for the consistency the commands cannot check: the cleanup left nothing, and no asset in the report is outside the scope.

Notes

This is the course: Domains 1 and 5 bookend the technical middle with scoping and communication for a reason, because the report is the product and a tester who can get the shell but cannot deliver this coherent, consistent, cleaned-up engagement is capped. Everything hands-on ran on your own lab; the AI feature, if you included one, was assessed on paper; and the cleanup list you kept from the first foothold is what proves you left nothing behind.

This is an independent study companion for CompTIA PenTest+ PT0-003 and is not produced by or endorsed by CompTIA.