Pentest Start

Engagement Start: $ARGUMENTS

You are beginning a penetration test engagement. Work through each step in order. Do not skip any section — missing information now creates problems during testing and reporting.

Step 1: Scope Definition

Ask the user for the following if not already provided. Do not proceed until all critical fields are filled:

Critical (must have before any testing):

• Target organization name
• In-scope targets: IP ranges, domains, URLs, applications
• Out-of-scope targets: explicitly excluded systems, third-party services
• Testing type: External / Internal / Web App / API / Red Team / Physical
• Authorized testing window: start date/time, end date/time, timezone
• Black box / Grey box / White box?

Important (get before active testing):

• Emergency contact name and phone number (for when something breaks)
• Credentials provided (if grey/white box): what access level?
• Can you cause service disruption? (DoS testing in scope?)
• Are production systems in scope, or only staging?

Nice to have:

• Previous assessment reports
• Known tech stack
• Compliance frameworks in scope (PCI, HIPAA, SOC2)

Step 2: Create Engagement Directory Structure

Once scope is confirmed, create this working directory:

engagement-<target-name>/
├── scope.md              ← Fill in from Step 1
├── findings/
│   ├── critical/
│   ├── high/
│   ├── medium/
│   ├── low/
│   └── informational/
├── evidence/             ← Screenshots, HTTP captures, tool output
├── recon/                ← OSINT, DNS, passive recon output
├── scans/                ← Nmap, Nuclei, scanner output
├── loot/                 ← Credentials, hashes, sensitive data found
└── notes.md              ← Running notes during testing

Create this structure now using your file tools.

Step 3: Generate scope.md

Create engagement-<target>/scope.md with the following content filled in from Step 1:

# Engagement Scope — [Target Name]

**Date:** [Today's date]
**Tester:** [Your name]
**Type:** [Assessment type]
**Window:** [Start] to [End] [Timezone]

## In Scope
[List all in-scope targets]

## Out of Scope
[List all out-of-scope targets]

## Rules of Engagement
- Testing window: [times]
- Disruption allowed: [Yes/No]
- Production systems: [In/Out of scope]
- Emergency contact: [Name — Phone]

## Credentials
[Any provided credentials and access level]

## Notes
[Any other relevant details]

Step 4: Reconnaissance Checklist

Generate a tailored recon checklist based on the scope. Include:

Passive (no active contact with target):

• WHOIS + reverse WHOIS on all domains
• DNS enumeration: A, MX, NS, TXT, SPF, DMARC, DKIM
• Certificate transparency search (crt.sh)
• Shodan/Censys: IP ranges and domains
• LinkedIn/OSINT: key personnel, tech stack signals
• GitHub/GitLab: exposed repos, leaked credentials
• Wayback Machine: historical URLs and content
• Google dorks: site:target.com filetype:pdf, etc.

Active (direct contact with target — only during authorized window):

• Nmap: full port scan all in-scope IPs
• Service fingerprinting on all open ports
• Web crawling: sitemap, robots.txt, JS source
• Directory fuzzing with ffuf
• Technology fingerprinting (whatweb, Wappalyzer)

Step 5: Confirm Ready to Test

Summarize the engagement details and ask for explicit confirmation before proceeding to active testing. Display:

ENGAGEMENT SUMMARY
==================
Target:     [Name]
Type:       [Type]
Window:     [Times]
In scope:   [Summary]
Out scope:  [Summary]
Emergency:  [Contact]

Ready to begin? (yes/no)

Do not begin active testing without an explicit "yes" from the user.