Module 12: Capstone — Full Penetration Test Report¶

← Module 11: Bug Bounty Programs | Topic Home

The capstone is where theory, tools, and technique combine into a single professional deliverable — a penetration test report that could be handed to a real client.

[!IMPORTANT] This module is the capstone for the entire Pentesting and Security topic. It requires synthesizing knowledge from all 11 preceding modules. Complete Modules 01–11 before starting.

Authorization reminder: This capstone uses DVWA (local Docker), Metasploitable 2 (local VM, host-only network), or a HackTheBox machine. Never perform these activities against real systems without written authorization.

Table of Contents¶

1. Overview
2. Prerequisites
3. Project Brief
4. Milestones
5. Report Template
6. Getting Unstuck
7. Acceptance Criteria
8. Cross-Links

Overview¶

A penetration test is only as good as its report. You can discover every vulnerability in a system, but if you cannot communicate those findings clearly — with evidence, impact analysis, CVSS scores, and actionable remediation — the value of your work is not realized by the client. This capstone builds that skill.

You will conduct a structured penetration test against a deliberately vulnerable application, follow the full methodology (reconnaissance → scanning → exploitation → post-exploitation → reporting), and produce a professional penetration test report in the format used by real consulting firms.

This is a build project — you drive it. The milestones and hints below keep you on track, but the analysis, findings, and report are yours to produce. Do not look for a sample completed report — work through the process and let the help sections guide you when stuck.

Prerequisites¶

• [[pentesting-security/modules/01_introduction]] through [[pentesting-security/modules/11_bug-bounty-program]] — All 11 modules must be completed
• Lab environment: DVWA running locally + Metasploitable 2 on host-only VM, OR a retired HackTheBox machine
• Kali Linux with: nmap, gobuster, Burp Suite Community, sqlmap, Metasploit

Project Brief¶

Scenario: You have been engaged as a penetration tester for "ACME Corp" (your local lab environment). You have received a signed Statement of Work with the following scope:

ENGAGEMENT SCOPE — ACME CORP SIMULATED PENTEST

Client: ACME Corp (simulated — your local lab environment)
Tester: [Your Name]
Engagement Type: Gray-Box Web Application + Network Penetration Test
Testing Window: Self-directed (your own schedule)
Scope:
  In Scope:
    - DVWA at http://localhost (web application)
    - Metasploitable 2 at 192.168.56.101 (network target)
    OR
    - [HackTheBox retired machine of your choice]
  Out of Scope:
    - Any system not listed above
    - Your host OS
    - Your home network

Objective: Identify, exploit, and report all security vulnerabilities in scope.
Deliverable: A professional penetration test report.

Milestones¶

Work through these milestones in order. Each milestone produces content for your report.

Milestone 1: Pre-Engagement Setup¶

Time: 1–2 hours

• Read the engagement scope above and confirm your lab environment is set up
• Create a working directory: ~/pentest/acme/
• Create subdirectories: recon/, exploitation/, evidence/, report/
• Start an activity log: activity_log.txt — record every command you run with timestamps
• Write the "Scope and Methodology" section of your report (template below)

Milestone 2: Reconnaissance¶

Time: 2–4 hours

For each in-scope target:

• Port scan: nmap -sV -p- -oA ~/pentest/acme/recon/nmap_target <target>
• Service enumeration: note every open port, service, and version
• Web application (DVWA): directory enumeration with gobuster, manual exploration
• Document findings in a "Reconnaissance Findings" section

Deliverable: A completed recon table:

| Port | Service | Version | Notes |
|------|---------|---------|-------|
| ... | ... | ... | ... |

Milestone 3: Vulnerability Analysis¶

Time: 2–3 hours

For each service and web feature identified in Milestone 2:

• Map each finding to a known vulnerability class or CVE (if applicable)
• Research versions against NVD and ExploitDB: searchsploit [service] [version]
• Prioritize the top 5 findings for exploitation

Deliverable: A prioritized vulnerability list:

| # | Vulnerability | Affected Component | CVSS (estimated) | Priority |
|---|---------------|-------------------|-----------------|----------|
| 1 | SQLi | DVWA /sqli | 9.1 | Critical |
| 2 | Stored XSS | DVWA /xss_s | 5.4 | Medium |
| ... | ... | ... | ... | ... |

Milestone 4: Exploitation¶

Time: 3–5 hours

Exploit the top 3–5 prioritized vulnerabilities. For each:

• Document the exact exploitation steps (commands, requests, screenshots)
• Capture evidence: terminal output, Burp Suite screenshots, or script output
• Determine the impact: what could an attacker do with this access?
• Do not extract real data beyond what proves the vulnerability exists

Minimum required findings for the report: - 1 Critical or High finding with full exploitation evidence - 2 Medium findings with evidence - 1 Low or Informational finding

msfconsole
use exploit/unix/ftp/vsftpd_234_backdoor
set RHOSTS 192.168.56.101
run

Milestone 5: Post-Exploitation Impact Assessment¶

Time: 1–2 hours

For each successful exploitation:

• What data was accessible? (describe categories, not actual content)
• What operations could an attacker perform?
• What is the blast radius (what other systems could be reached)?
• Write the business impact statement for each finding

Milestone 6: Report Writing¶

Time: 4–6 hours

Produce your complete penetration test report. Use the template below. The report must include all sections in the template.

Report Template¶

# PENETRATION TEST REPORT
## ACME Corp — Web Application and Network Assessment

**Prepared by:** [Your Name]
**Date:** [Date]
**Engagement ID:** 2026-001
**Classification:** CONFIDENTIAL

---

## Table of Contents
1. Executive Summary
2. Scope and Methodology
3. Findings Summary
4. Detailed Findings
5. Remediation Roadmap
6. Appendices

---

## 1. Executive Summary

[1-2 pages, non-technical audience. Cover:]
- What was tested and when
- Overall security posture assessment (Critical/High/Medium/Low)
- The single most important finding and its business impact
- High-level remediation priorities

---

## 2. Scope and Methodology

**In-Scope Assets:**
[List]

**Testing Methodology:** PTES (Penetration Testing Execution Standard)

**Testing Phases:**
1. Reconnaissance: [dates/hours]
2. Scanning and Enumeration: [dates/hours]
3. Exploitation: [dates/hours]
4. Post-Exploitation Analysis: [dates/hours]

**Tools Used:**
| Tool | Version | Purpose |
|------|---------|---------|
| nmap | [version] | Port scanning and service enumeration |
| gobuster | [version] | Directory and file fuzzing |
| Burp Suite Community | [version] | Web application testing |
| Metasploit Framework | [version] | Exploitation framework |
| sqlmap | [version] | SQL injection testing |

---

## 3. Findings Summary

| # | Finding | Severity | CVSS | Status |
|---|---------|----------|------|--------|
| F-001 | [Name] | Critical | 9.1 | Open |
| F-002 | [Name] | High | 7.5 | Open |
| ...  | ...     | ...      | ... | ...   |

**Severity Distribution:**
- Critical: [N]
- High: [N]
- Medium: [N]
- Low: [N]
- Informational: [N]

---

## 4. Detailed Findings

### F-001: [Vulnerability Name]

**Severity:** Critical
**CVSS Score:** [X.X] (CVSS:3.1/[vector])
**Affected Asset:** [URL/IP/Service]
**CWE:** [CWE-XX: Name]

**Description:**
[2-3 paragraphs explaining what the vulnerability is, why it exists, and why it is significant]

**Reproduction Steps:**
1. [Step 1]
2. [Step 2]
3. [Step 3 — include exact commands or HTTP requests]

**Evidence:**

**Impact:**
[What an attacker can do with this finding. Be specific.]

**Recommendation:**
[Specific, technical, actionable fix]

**References:**
- OWASP: [relevant link]
- CWE: [CWE link]

---
[Repeat for each finding]

---

## 5. Remediation Roadmap

| Priority | Finding | Effort | Recommendation |
|----------|---------|--------|----------------|
| Immediate | F-001 SQLi | Low | Implement parameterized queries |
| Short-term (30 days) | F-002 XSS | Low | Implement output encoding |
| Medium-term (90 days) | F-003 ... | Medium | ... |

---

## Appendices

### Appendix A: Screenshots and Evidence
[Paste terminal output and screenshots here]

### Appendix B: nmap Output
[Full nmap scan output]

### Appendix C: Activity Log
[Your timestamped activity log]

Getting Unstuck¶

Acceptance Criteria¶

Your capstone is complete when the report includes:

• An Executive Summary (non-technical audience, 1-2 pages)
• Scope and Methodology section with tool list
• At least 5 distinct findings (at least 1 Critical or High)
• Each finding has: title, severity, CVSS score, reproduction steps, evidence, impact, remediation
• At least 3 findings include code snippets showing the vulnerable code and the fix
• Remediation Roadmap prioritizing all findings
• Complete appendices with raw tool output

Cross-Links¶

• All modules in [[pentesting-security]] contribute to this capstone
• [[pentesting-security/modules/11_bug-bounty-program]] — The report format follows professional pentest report conventions
• [[devops-platform-engineering]] — Cloud and container misconfigurations are common findings in real engagements