Execute Comprehensive Penetration Tests

Provides a comprehensive checklist for planning, executing, and following up on authorized penetration tests - covering scoping, environment preparation, tester selection, monitoring, and remediation. Restricted to authorized security assessments, defensive validation, or controlled educational environments.

Use this skill when scoping a new penetration test engagement, preparing an environment for testing, selecting and evaluating qualified pentesters, setting up monitoring to distinguish test activity from real attacks, or planning post-test remediation and retesting. Not a fit for unauthorized testing of systems without explicit permission and legal agreements.

Requires clear business objectives, target environment information, budget/timeline constraints, stakeholder authorization, and legal agreements/scope documents as prerequisites; produces a defined scope, prepared test environment, monitoring data, a vulnerability findings report, and a remediation plan with verification.

Phase 1 (scope definition) clarifies testing purpose and success criteria, distinguishes five test types (external, internal, web application, social engineering, red team) by purpose and scope, enumerates likely threats and high-risk/critical assets, defines in-scope/out-of-scope systems and testing boundaries, and plans budget against asset value, complexity, and required depth - noting cheap pentests often produce poor results.

Phase 2 (environment preparation) decides between production, staging, or a clone environment (each with explicit risk/realism tradeoffs), runs preliminary vulnerability scans (example nmap --script vuln and nikto commands) to fix obvious issues before the real test, reviews compliance requirements (GDPR, PCI-DSS, HIPAA) and legal authorization, notifies the cloud hosting provider per its penetration testing policy (AWS, Azure, GCP), and freezes deployments during the test window.

Phase 3 (expertise selection) covers finding qualified pentesters via recommendations and credential verification (OSCP, GPEN, CEH, CREST), evaluating experience/methodology/reporting/communication, choosing a testing standard (PTES, OWASP, NIST) and access level (black box/gray box/white box), and defining the required report format (executive summary, technical findings with evidence, risk ratings, remediation recommendations, retesting guidance).

Phase 4 (monitoring) covers deploying IDS/IPS, enabling comprehensive logging and SIEM configuration, centralizing and retaining logs, tracking error rate spikes to distinguish testing from attacks, and reviewing IDS/WAF/endpoint alerts. Phase 5 (remediation) covers verifying backup integrity, reserving time for fix implementation and verification testing, generally avoiding patching during the test window (except for critical security emergencies), a cleanup procedure removing test artifacts and accounts and restoring configurations, and scheduling the next test based on release frequency, regulatory requirements, and risk tolerance.

Provides pre- and post-pentest checklists, a worked scope-definition example (gray box web app pentest, 5 days, DoS/production-database excluded), a monitoring setup example (rsyslog/auditd restart, tcpdump capture), and a troubleshooting table covering scope creep, production impact, disputed findings, delayed remediation, and budget overruns.

References vulnerability scanning tools (nmap, nikto), monitoring tools (IDS/IPS, SIEM, tcpdump, auth/access logs), and cloud provider penetration testing authorization policies (AWS, Azure, GCP).

Security teams and engagement managers planning an authorized penetration test who need a complete scoping-through-remediation checklist rather than an ad hoc test process.

nmap -sV --script vuln TARGET
nikto -h http://TARGET