Capstone: Full-Scope Web Application + Infrastructure Pentest

Prerequisites

All PEN-C01, PEN-C02, and PEN-C03 core cards completed.

Why This Lesson Matters

A controlled environment where you complete a full engagement from scope to report is the only way to develop real pentest competency. This capstone connects every skill: passive recon, active enumeration, web vulnerability exploitation, service exploitation, and privilege escalation — with a professional report as the final deliverable.

1. Engagement Brief

Scope: - External host (direct access): external.corp.lab - Internal host (pivot required): internal.corp.lab — reachable only via external - Web application on both hosts - VPN provided; test window: duration of lab session

Rules of Engagement: - Permitted: web application testing, network scanning, exploitation, privilege escalation - Prohibited: DoS, data destruction, persistence beyond flag collection - Deliverable: brief finding summary (title + CVSS + remediation) for each finding

2. Recommended Workflow

Phase 1 — Recon (20 min)
  Passive: cert transparency, WHOIS, HTTP headers
  Active: Nmap full scan, gobuster on web application

Phase 2 — Vulnerability Identification (20 min)
  Review service versions against CVE databases
  Test web application for top 5 vulnerabilities

Phase 3 — Exploitation (30 min)
  Exploit highest-priority finding
  Escalate privileges if possible

Phase 4 — Pivot & Internal (20 min)
  Establish SOCKS proxy via compromised external host
  Enumerate internal host
  Exploit internal vulnerability

Phase 5 — Documentation (30 min)
  For each confirmed finding: title, CVSS, evidence screenshot, remediation
  Collect all flag proofs

3. Reporting Template (Mini-Report)

CAPSTONE FINDINGS SUMMARY

Tester: [Name] | Date: [Date] | Engagement: PEN-CAPSTONE-001

F001 — [Title]
  CVSS: [Score] / [Severity]
  Evidence: [description or screenshot reference]
  Remediation: [one sentence]

F002 — [Title]
  ...

FLAGS COLLECTED:
  External host: /flag_proof = [value]
  Internal host: /root/flag_proof = [value]
  Submit: PREFIX{external_flag:internal_flag}

4. Lab

Assessment mode: ctf

challenge_spec_id: 315 — OFFSEC Medium

Task: 1. Complete all five phases 2. Collect both flags (external host + internal host) 3. Write a mini finding summary (2–3 findings) 4. Submit: PREFIX{external_flag:internal_flag}

5. Framework Alignment

6. Further Reading

• HackTheBox / TryHackMe — Continuously updated machines matching this style
• OffSec Proving Grounds — https://portal.offensive-security.com — The original OSCP training platform
• TCM Security Practical Ethical Hacking — Video course that mirrors this engagement format

["Complete a full five-phase pentest engagement (recon, vulnerability identification, exploitation, pivot, documentation) against a two-host topology", "Collect flag proofs from both an external and an internal host (reached via SOCKS pivot) and submit them in the required format", "Produce a mini finding summary with CVSS scores and one-sentence remediation for two confirmed vulnerabilities identified during the engagement"]

Engagement brief → Recommended workflow (5 phases with time allocations) → Mini-report template → CTF lab (OFFSEC Medium, spec 315) → Framework alignment → Further reading