Capstone — submit full penetration test report — Offensive Security & Penetration Testing

What You'll Build

This is the culminating project: you will assemble everything from the capstone engagement into a complete, professional penetration test report and submit it as the final deliverable. The report brings together an executive summary, detailed technical findings, CVSS-based severities, context-aware prioritisation, and the connected attack-chain narrative, serving both leadership and engineers. Producing this report is the true measure of the course, demonstrating that you can conduct a full engagement and communicate it in a way that actually drives an organization to improve.

Analogy🏏Cricket

🎬 Think of it like movies: Producing a film means running every department, scouting, shooting, editing, sound, then delivering one coherent final cut a distributor can actually screen, not a pile of loose reels. Just as the producer is judged by that single assembled cut, this exercise judges you by one consolidated, prioritized inventory drawn from passive discovery, active scanning, enumeration, and vulnerability triage. Just as no scene is shot without the studio's sign-off, none of this runs outside your authorized lab range. This reveals the recon sweep as delivering the final cut, not a heap of unassembled footage.

Prerequisites

The complete engagement from Lessons 31 through 34, the brief, the recon and attack chain, the validated exploitation, and the scored findings.
The two-audience reporting structure from Lesson 28, an executive summary plus detailed technical findings, each pitched to its reader.
CVSS and context-aware, chain-aware prioritisation from Lessons 29 and 34, ranking fixes by real risk.
The ethical reporting obligation from Lesson 27, complete, honest, transparent disclosure of everything, including any mistakes.
The connected-chain narrative from Lesson 31, so the report tells how findings combine into real risk, not just a bug list.

Setup & Project Structure

Gather every artifact from the engagement, the scope and brief, the attack chain, the validated exploitation evidence, and the scored, prioritized findings, and set up the report's structure. Because this report is the entire engagement's deliverable, assemble it deliberately, with clear sections for each audience and purpose. Everything you documented continuously throughout now converges here, which is precisely why the documentation discipline stressed since Lesson 27 has been so important to the final result.

Analogy🏏Cricket

💪 Think of it like fitness: Serious athletes train in a controlled gym they are cleared to use and keep a meticulous logbook, dating every set and weight so progress is reproducible and any coach can pick up exactly where they left off. Just as that controlled environment and dated logbook make training safe and auditable, working inside an authorized lab and saving each phase's output in dated, named files makes the recon sweep safe and reproducible. Just as an undocumented workout teaches nothing repeatable, an undocumented sweep produces findings no teammate can trust. This reveals disciplined setup as the training log that makes every result traceable.

bash

# Assemble the final report from all engagement artifacts.
cd capstone && mkdir -p report

# Structure the deliverable for BOTH audiences and full transparency.
cat > report/outline.md <<'EOF'
# Penetration Test Report — <capstone lab engagement>

1. Executive Summary       (leadership: risk, priorities, plain language)
2. Scope & Methodology     (authorized targets + how they were tested)
3. Attack Chain Narrative  (how findings CONNECT into real risk)
4. Technical Findings      (engineers: severity, repro, evidence, fix)
5. Remediation Priorities  (CVSS + business + chain context -> fix order)
EOF
cat report/outline.md

Step 1 — Assemble Findings and the Chain Narrative

Start with the technical substance you prepared in Lesson 34: bring every scored, evidenced finding into the report's technical section, then write the attack-chain narrative that connects them, showing how an attacker could move from foothold to real impact. This narrative is what elevates the report from a bug list to a risk story, and it demonstrates the full-scope thinking the capstone is built around. Ensure each finding remains precise and reproducible for the engineers who will fix it.

Analogy🏏Cricket

💪 Think of it like fitness: A good coach does not hand an athlete a bare list of test numbers, they present each measurement, then narrate how the numbers connect into one story: weak stabilizers feed a poor squat, which feeds the injury risk. Just as that narrative turns isolated stats into an understood, actionable picture, your attack-chain narrative turns isolated findings into an understood picture of real risk. Just as the connected story motivates a training change, the connected chain motivates a security fix. This reveals why the narrative is what elevates the report from a bug list to a risk story.

bash

# Bring findings + chain narrative into the report.
cat findings/*.md > report/technical_findings.md   # scored, evidenced

cat > report/attack_chain_narrative.md <<'EOF'
## Attack Chain Narrative
Foothold -> escalation -> lateral movement -> impact, showing how
individual findings COMBINE into serious real risk.
Note: breaking any one key link would neutralize the path.
EOF
cat report/attack_chain_narrative.md