Capstone project for Offensive Security: Ethical Hacking and Pentesting
Pentest the practice Partner app and store network
You are contracted to test the practice Partner app and the lab store network over a simulated two-week engagement. Everything you test is the course's practice environment, which you are authorised to test; you never touch a real system. Agree and write down the scope and rules of engagement, run the testing in a safe and methodical way, keep evidence, and deliver a professional report. The report must let Mangrove's leadership understand the business risk and let the engineers reproduce and fix each finding.
What you hand in
- Signed-off scope and rules of engagement for the practice environment
- Testing notes with reproducible evidence for each finding, kept in scope
- A findings table with consistent risk ratings (CVSS plus business context)
- A full report with an executive summary, detailed findings and a retest plan
Check your work
Tick each item when your project meets it. Be strict: this is the rubric the reviewer uses.
- Testing stays strictly inside the written scope and rules of engagement, and the report says so explicitly
- Each finding has reproducible evidence, a clear business impact for Mangrove and a concrete fix with a reference
- Risk ratings are consistent and justified, using CVSS as a starting point and adjusting for business context rather than quoting it blindly
- The attack narrative shows how findings chain together (for example recon to a web flaw to a foothold to lateral movement) rather than listing isolated issues
- The executive summary is readable by a non-specialist: the risk, the few things to fix first and the cost of not acting
- A retest plan says how each fix will be verified and findings closed
0 of 6 checked
Model answer
The model answer opens once your capstone passes the review, so you can compare your work with an outline of a strong submission.
Hand in your capstone
Your links are checked automatically, then the work is scored against the rubric above, item by item, with comments. A pass counts toward the course certificate and shows on your profile.
Loading…