Capstone — Scoping and Planning a Real Engagement

Nine chapters built one continuous process: authorization, scope, framework, recon, scanning, matching, exploitation, post-exploitation, reporting. This capstone walks that entire process end to end for a single fictional target — Meridian Retail Co., a fictional online retailer — combining every prior chapter into one coherent engagement.

The Scenario

Meridian Retail Co. is preparing for a major holiday sales push and wants its online store and supporting infrastructure tested before traffic peaks. They've requested a Gray Box engagement (per pentest1-2) — testers will be given a standard customer account, but no source code or administrative access — scoped to their Web Application and Network categories.

Sample Rules of Engagement Document

CopyMERIDIAN RETAIL CO. — RULES OF ENGAGEMENT (SAMPLE, FICTIONAL)
================================================================
Client:                Meridian Retail Co.
Authorized signatory:  [Name], VP of Engineering
Testing firm:          [Firm Name]
Engagement type:       Gray Box (pentest1-2) — one standard
                        customer account provided, no source
                        code or admin access
Scope — IN:
  - shop.meridianretail.example (production web application)
  - api.meridianretail.example
  - IP range 203.0.113.0/24 (Meridian's own hosted infrastructure)
Scope — OUT:
  - payments.meridianretail.example (third-party payment
    processor infrastructure, NOT owned by Meridian — see
    pentest1-2's own shared-infrastructure warning)
  - Any Meridian employee's personal social media (OSINT on
    named individuals excluded per pentest1-4's own scope note)
Testing window:        Weekdays, 22:00-06:00 local time only
                        (low-traffic hours, per pentest1-5's own
                        scan-intensity guidance)
Methodology:            PTES (pentest1-3)
Escalation contact:     [Name], available 24/7 during the window
Emergency stop:         Testing halts immediately on request from
                        either party; no penalty for invoking it
Explicitly authorized:  Testing up to proof-of-concept level
                        (pentest1-7) — NOT data destruction,
                        NOT denial-of-service, NOT extraction
                        beyond a single non-sensitive record
Signatures:             ______________________  ______________________
                        Client                   Testing Firm
================================================================

Walking Through the Methodology

1. Pre-engagement (pentest1-1 / pentest1-2): the RoE above is signed by someone with real authority over Meridian's own systems, before any technical activity begins.
2. Framework (pentest1-3): the engagement follows PTES's seven phases, matching this course's own structure directly.
3. Reconnaissance (pentest1-4): passive WHOIS/DNS enumeration reveals Meridian's own hosting provider and mail infrastructure; a public job posting reveals a React/Node.js stack; employee LinkedIn presence is noted but not investigated further, per the RoE's own exclusion.
4. Scanning & Enumeration (pentest1-5): confirms shop.meridianretail.example and api.meridianretail.example are alive, with ports 443 and — unexpectedly — 3306 (MySQL) directly reachable; a SYN scan run only during the authorized window identifies service versions.
5. Vulnerability Analysis (pentest1-6): the reachable 3306 port is flagged as a dbsec1-style candidate (a database that should never be directly internet-facing); the checkout page's search field is flagged as a sqli1 candidate; the login form is flagged as a bc1 candidate.
6. Exploitation (pentest1-7): a single non-sensitive proof-of-concept row (the database version string) is extracted via the checkout search field, confirming the SQLi candidate; the login form's session cookie is confirmed to be missing the Secure flag. Testing stops at proof-of-concept for both — no customer data is touched.
7. Post-Exploitation (pentest1-8): using the Gray Box starting account, the tester confirms the compromised checkout server can also reach an internal admin panel not exposed externally — a real lateral-movement path — and stops there, without logging into the panel itself.
8. Reporting (pentest1-9): the final report includes an executive summary (three findings, one Critical, two High, business impact framed around the upcoming sales push) and technical findings with CVSS scores and reproduction steps, with remediation pointing directly at dbsec1 (network isolation for the database), sqli1 (parameterized queries), and bc1 (proper cookie flags).

Chapter Attribution

Hands-On Exercises