Capstone · Ethical Hacking and Penetration Testing (legal labs)
Capstone: a full penetration test and report
The brief
Run a complete, legal penetration test of your lab (Metasploitable 2 and DVWA) from authorisation to retest, and write the professional report that is the real deliverable: scope, methodology, findings with CVSS and evidence, a lab exploitation, remediation and an executive summary. Every attack is paired with its fix.
Why it matters
The report, not the exploit, is what a client pays for and what gets you hired. A clear, well-evidenced pentest report that any manager can read and any developer can act on is the strongest single item in a junior pentester's portfolio.
Skills you practise
- engagement scoping
- nmap scanning and enumeration
- CVSS triage
- web and service exploitation (lab)
- ethical post-exploitation
- remediation and retesting
- professional report writing
You need
- Your isolated lab: Kali, Metasploitable 2 and DVWA on a host-only network
- The authorisation document from the ethics lab
- nmap, Metasploit and curl (all in Kali)
What you will have at the end
A portfolio-ready penetration test report (pentest-report.md) backed by report_tools.py, covering scope, methodology, CVSS-triaged findings with evidence and fixes, a lab exploitation, a retest and an executive summary.
How it is marked (rubric, 100 points)
| Full methodologyScope, discovery, scanning, enumeration, exploitation and retest were all carried out in the lab and evidenced. | 25 |
|---|---|
| Tooling codein_scope, cvss_band and risk_order pass every check. | 20 |
| Findings and fixesFindings are CVSS-banded worst-first, each with real evidence and a correct, actionable fix. | 30 |
| Report qualityThe report is clear, complete and professional, with a plain-English executive summary and a repeatable appendix, and no real data. | 25 |
0/11 steps done
Step 1 of 11
Scope and authorisation
in_scope(ip, SCOPE) gates your testing, and the report's scope section is filled in.
Start exactly as a real engagement does. Confirm your targets are in the authorised scope with in_scope(), and write the scope and authorisation section of the report: who authorised it, the target addresses, the dates and what is excluded.
Run shows what your code prints. Check runs the step's tests. Ctrl+Enter checks too.