B7: Professional Delivery & Capstone
Capstone: Full Enterprise Pentest Simulation
Run an end-to-end assessment: scope, recon, web foothold, AD/cloud path, privilege escalation, detection, and final report.
Open the interactive lesson & lab →
- Scoping pack: define assets, test windows, excluded actions, emergency contacts, and success criteria.
- Recon pack: domains, IP ranges, tech stack, exposed services, employees/roles, cloud footprint, and initial assumptions.
- Web/API pack: auth, access control, injection, SSRF, file handling, business logic, and evidence capture.
- Internal pack: Linux/Windows enumeration, AD graph, privilege paths, credential hygiene, and lateral movement risk.
- Cloud/container pack: IAM paths, exposed storage, CI/CD secrets, Kubernetes RBAC, workload identities, and logs.
- Detection pack: likely telemetry, Sigma/YARA ideas, Sysmon coverage, and incident-response notes.
- Report pack: executive summary, attack chain diagram, CVSS v4 scoring, finding details, remediation plan, and retest checklist.
Capstone scoring rubric
| Area | 10/10 evidence | Fail condition |
|---|---|---|
| Scope control | Every action maps to written scope, timing, and allowed test type. | Unclear authorization or out-of-scope assumptions. |
| Attack chain | A complete path from initial exposure to business impact with clean evidence. | Isolated findings with no impact story. |
| Technical depth | Root cause, trust boundary, affected assets, limits, and safe reproduction. | Tool output pasted without explanation. |
| Defense value | Detection ideas, logging gaps, and containment notes for each major chain. | No blue-team guidance. |
| Remediation | Prioritized fixes by owner with validation and retest steps. | Generic advice that engineers cannot implement. |
| Executive clarity | One-page risk narrative with impact, likelihood, and business decision points. | Only low-level technical detail. |
Final submission package
- Executive summary: what matters, why now, and what to fix first.
- Attack-chain diagram: external entry, identity path, privilege path, data/impact path.
- Technical findings: exact evidence, affected assets, reproduction, root cause, remediation.
- Detection appendix: telemetry sources, Sigma/YARA-style logic ideas, and false-positive notes.
- Retest plan: what commands, logs, screenshots, and business workflows prove the fix worked.
- Ethics appendix: scope boundaries, testing windows, data handling, and cleanup notes.