Full Engagement

This is a guided, end-to-end scenario. You are handed a scope and a target environment and you work the full lifecycle in order, carrying the findings of each stage forward into the next — exactly the way the artifacts of a real engagement accumulate. It is where the separate labs across this track connect into one continuous story, ending in a deliverable you assemble yourself.

Work the stages top to bottom. Each one explains what you are trying to achieve, sends you into the matching lab to do it, and tells you what to carry forward. By the last stage you will have walked a target from a name on a scope document to a compromised network and a finished report.

1. Scope & Rules of Engagement

   Read the authorization, confirm what is in and out of scope, and set the rules before touching anything.

2. Reconnaissance

   Build the target picture from public information before going active.

3. Scanning & Enumeration

   Map live hosts, ports, and the exact services behind them.

4. Vulnerability Analysis

   Turn the service inventory into a ranked list of validated weaknesses.

5. Exploitation

   Prove the top findings are real by gaining a foothold.

6. Post-Exploitation

   Escalate, pivot to the objective, gather evidence of impact — then clean up.

7. Reporting

   Assemble the findings into a clear, prioritized deliverable.

Your client is Valley Veterinary Ventures, a regional veterinary group running an online patient portal and an internal network that holds animal medical records, billing, and staff accounts. They have engaged you for a grey-box penetration test: you get a network range and a portal URL, nothing more. You are simulating the Vortex Collective — a financially-motivated, organized cybercrime crew of the kind most organizations actually face (the middle of the capability ladder), the sort that would ransom the records or sell access.

Before a single packet, the scope is settled in writing. Everything that follows happens inside these lines:

You start where the Vortex Collective would: with whatever the internet already knows about Valley Veterinary Ventures. No packets to their network yet — just open sources. You map the domain and subdomains, harvest staff email addresses, check breach datasets for already-exposed credentials, and hunt for documents and configuration the clinic never meant to publish. A well-aimed search dredges up an exposed configuration file with a credential in it and the address of the patient portal.

Carry forward: a target host list, harvested staff emails, one leaked credential, and the patient-portal URL.

Now you go active, inside the agreed window. You sweep 10.10.10.0/24 for live hosts, then map the open ports and pin down the exact software and versions behind them. The clinic's records host answers on SSH, a web server, and MySQL — and a careful all-ports scan turns up a service on a high port that a default scan would have missed entirely. That service inventory is the raw material every later stage depends on.

Carry forward: live hosts, open ports, and named-and-versioned services — including the build server and the records host.

A list of services is not yet a list of problems. Here you turn the inventory into a ranked set of validated weaknesses: cross-reference each version against public exploit databases, run a scanner to cast a wide net, then manually confirm what is real and discard the false positives. The leaked credential from recon turns out to unlock a build server left on its default administrator account; an end-of-life service on the records host is confirmed exploitable. You score each finding with a single consistent metric so the worst rises to the top.

Carry forward: a CVSS-ranked list of validated vulnerabilities, worst first.

Time to prove the risk is real by getting in. Two demonstrated paths open up. The patient portal is a web application, and probing it with an intercepting proxy reveals an upload flaw you can ride into code execution T1190; alternatively, the validated service vulnerability gives a direct route via a framework exploit. Either way you land your first foothold — a shell on an internal host. The leaked and default credentials you collected earlier make T1078 (valid accounts) an even quieter way through the front door.

Carry forward: an interactive session on an internal host, and notes on exactly how you got it.

A foothold is the beginning, not the end. From your session you escalate privileges T1068, establish enough persistence to survive a reboot, and pivot toward the objective — the records database. You harvest credentials along the way T1003 and move laterally T1021 until you can demonstrate access to the patient records and a path to domain control. Crucially, you stop at proof: a screenshot that shows you could reach the data, not a copy of the data itself. Then you clean up your own artifacts and leave the environment as you found it.

Carry forward: evidence of impact (sanitized screenshots), the full path to the crown jewels, and the ATT&CK techniques you exercised.

The access is gone; the value that remains is the report. Now you assemble everything into the deliverable Valley Veterinary Ventures actually paid for. Each weakness becomes a finding — title, severity, observation, business impact, evidence, affected asset, recommendation — rated by likelihood and impact and sorted so the worst leads. You write the executive summary for the clinic's leadership in plain business terms, the technical detail for their IT staff (mapped to ATT&CK so they can check their detections), and you deliver it as a locked PDF.

Deliver: a prioritized, business-readable report with reproducible technical findings and actionable remediation — the product of the whole engagement.

Look back at what just happened. A name on a scope document became a recon picture; the picture became a service map; the map became a ranked set of validated weaknesses; the weaknesses became a foothold; the foothold became the crown jewels; and the whole thing became a report a clinic can act on. Each stage's output was the next stage's input — that flow is the methodology, and you have now walked it end to end rather than read about it.

Notice the discipline threaded through every stage: you stayed inside a written scope, you stopped at proof instead of plunder, you obfuscated the secrets you found, and you cleaned up after yourself. The skills are what get you in; that discipline is what makes you a professional someone is willing to hire and trust.