dragonked2 / pentest-ops

PENTEST OPERATIONS — ENGAGEMENT LIFECYCLE

Turn random testing into structured, professional pentest operations.

1. OPERATION LIFECYCLE

Every engagement follows 5 phases. Track progress through each.

┌─────────────┐    ┌─────────────┐    ┌─────────────┐    ┌─────────────┐    ┌─────────────┐
│  1. PLAN    │───→│  2. RECON   │───→│  3. ATTACK  │───→│  4. REPORT  │───→│  5. HANDOFF │
│  Scope      │    │  Map        │    │  Exploit    │    │  Document   │    │  Deliver    │
│  Rules      │    │  Enumerate  │    │  Chain      │    │  Severity   │    │  Debrief    │
│  Identity   │    │  Fingerprint│    │  Escalate   │    │  PoC        │    │  Cleanup    │
└─────────────┘    └─────────────┘    └─────────────┘    └─────────────┘    └─────────────┘

Phase 1: Planning & Scope

## Engagement Card

- **Target:** example.com
- **Type:** Web Application Pentest
- **Scope:**
  - IN: *.example.com (web apps, APIs)
  - IN: app.example.com (main application)
  - IN: api.example.com (REST API)
  - OUT: *.staging.example.com (staging environments)
  - OUT: admin.internal.example.com (admin panel — out of scope)
- **Rules of Engagement:**
  - No social engineering
  - No denial of service
  - No physical access testing
  - Testing hours: 09:00-18:00 UTC
  - Contact: security@example.com
- **Unauthorized actions = engagement terminated**

Phase 2: Reconnaissance

See recon subskill for full methodology.

Phase 3: Attack

Priority order:
1. Critical/High vulns first (RCE, SQLi, ATO)
2. Chains (low + medium = critical)
3. Business logic
4. Everything else

Phase 4: Report

See report subskill for full methodology.

Phase 5: Handoff

Deliverables checklist:
- [ ] Executive summary (1 page)
- [ ] Technical findings (detailed)
- [ ] PoC for each finding
- [ ] Remediation recommendations
- [ ] Risk rating per finding
- [ ] Timeline of testing
- [ ] Tools used
- [ ] Contact for questions

2. TARGET CLASSIFICATION

Classify every target before testing. Different shapes = different playbooks.

By Protocol

By Maturity

3. OPSEC CONTROLS

Operational security protects YOUR identity and keeps the engagement clean.

Identity Management

FOR EVERY ENGAGEMENT:

1. USE DEDICATED IDENTITIES
   - Separate email (protonmail/tutanota)
   - Separate phone number (google voice/burner)
   - VPN always on
   - Separate browser profile (Firefox container)

2. NEVER MIX
   - Personal email with test accounts
   - Work credentials with test credentials
   - Real name with test personas
   - Company VPN with engagement VPN

3. CLEAN UP AFTER
   - Delete test accounts (or document them)
   - Clear browser data
   - Rotate VPN
   - Archive evidence securely

Traffic Management

STRICT OPSEC MODE:
- Block all traffic to third-party intel hosts
  (crt.sh, otx.alienvault.com, virustotal.com,
   shodan.io, urlscan.io, wayback-api.archive.org)
- Only use pre-approved reconnaissance methods
- Log all outbound connections
- Use proxychains/tor for sensitive recon

NORMAL OPSEC MODE:
- Standard scope enforcement
- Allow passive OSINT
- Log interesting findings immediately

Scope Enforcement

SCOPE RULES:
1. NEVER test out-of-scope targets
2. NEVER pivot to third-party services without authorization
3. NEVER access other customers' data
4. NEVER cause service disruption
5. ALWAYS document what you tested
6. ALWAYS stop if you find evidence of prior compromise
7. ALWAYS notify if you find critical vulns during testing

4. OPERATION STATE TRACKING

Track your operation state in a structured way:

## Operation: example.com Pentest

**Status:** Active | Phase 3 (Attack)
**Started:** 2026-01-15
**Target:** example.com

### Scope
- IN: *.example.com
- OUT: staging.example.com

### Findings Summary
| Severity | Count | Status |
|----------|-------|--------|
| Critical | 0 | - |
| High | 2 | Verified |
| Medium | 5 | 3 verified, 2 candidate |
| Low | 8 | 5 verified, 3 candidate |
| Info | 12 | Various |

### Activity Log
- [2026-01-15 09:00] Started recon
- [2026-01-15 10:30] Found 47 subdomains
- [2026-01-15 14:00] Completed port scan
- [2026-01-16 09:00] Started attack phase
- [2026-01-16 11:00] Found IDOR on /api/users/{id}
- [2026-01-16 14:00] Found SQLi on /search

### Evidence Collected
- EVD-001: IDOR PoC (curl request + response)
- EVD-002: SQLi PoC (error message + data extraction)

5. PHASE TRANSITIONS

When to move between phases:

PLAN → RECON:
  ✓ Scope defined and agreed
  ✓ Rules of engagement documented
  ✓ Identities prepared
  ✓ Tools verified (see tool-doctor)

RECON → ATTACK:
  ✓ Subdomains mapped
  ✓ Live hosts identified
  ✓ Technologies fingerprinted
  ✓ Attack surface documented
  ✓ High-value targets identified

ATTACK → REPORT:
  ✓ All critical/high vulns found and verified
  ✓ Chains documented
  ✓ PoCs created for each finding
  ✓ False positives ruled out
  ✓ No more time budget

REPORT → HANDOFF:
  ✓ All findings documented
  ✓ Report reviewed
  ✓ Remediation guidance written
  ✓ Delivery scheduled

6. QUICK COMMANDS

# Start a new pentest operation
/pwn https://example.com

# Check scope status
/scope status

# Switch to strict OPSEC
/opsec strict

# Check tool readiness
/doctor

# Export operation
/share

7. PROFESSIONAL PENTEST CHECKLIST

PRE-ENGAGEMENT:
- [ ] Rules of engagement signed
- [ ] Scope boundaries defined
- [ ] Emergency contacts established
- [ ] Testing window confirmed
- [ ] Identities and VPN ready
- [ ] Tools verified (tool-doctor)

DURING TESTING:
- [ ] Stay within scope
- [ ] Document everything
- [ ] Screenshot important findings
- [ ] Verify every finding
- [ ] Chain low findings into high
- [ ] Track time per target

POST-ENGAGEMENT:
- [ ] All findings documented
- [ ] PoCs created and verified
- [ ] Report written
- [ ] Remediation guidance provided
- [ ] Evidence archived securely
- [ ] Test accounts cleaned up
- [ ] Client debrief scheduled