# Pentest Start

> Kicks off a penetration test engagement. Sets up scope, rules of engagement, target inventory, and working directory structure. Invoke manually at the start of any assessment.

- Skill: `njones17/pentest-start` (Agent Skill)
- Install (CLI): `npx skillmds@latest add njones17/pentest-start`
- Raw SKILL.md: https://api.skillmd.com/api/skills/njones17/pentest-start/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: Njones17 (https://skillmd.com/u/njones17)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/njones17/pentest-start

---


# Engagement Start: $ARGUMENTS

You are beginning a penetration test engagement. Work through each step in order. Do not skip any section — missing information now creates problems during testing and reporting.

## Step 1: Scope Definition

Ask the user for the following if not already provided. Do not proceed until all critical fields are filled:

**Critical (must have before any testing):**
- Target organization name
- In-scope targets: IP ranges, domains, URLs, applications
- Out-of-scope targets: explicitly excluded systems, third-party services
- Testing type: External / Internal / Web App / API / Red Team / Physical
- Authorized testing window: start date/time, end date/time, timezone
- Black box / Grey box / White box?

**Important (get before active testing):**
- Emergency contact name and phone number (for when something breaks)
- Credentials provided (if grey/white box): what access level?
- Can you cause service disruption? (DoS testing in scope?)
- Are production systems in scope, or only staging?

**Nice to have:**
- Previous assessment reports
- Known tech stack
- Compliance frameworks in scope (PCI, HIPAA, SOC2)

## Step 2: Create Engagement Directory Structure

Once scope is confirmed, create this working directory:

```
engagement-<target-name>/
├── scope.md              ← Fill in from Step 1
├── findings/
│   ├── critical/
│   ├── high/
│   ├── medium/
│   ├── low/
│   └── informational/
├── evidence/             ← Screenshots, HTTP captures, tool output
├── recon/                ← OSINT, DNS, passive recon output
├── scans/                ← Nmap, Nuclei, scanner output
├── loot/                 ← Credentials, hashes, sensitive data found
└── notes.md              ← Running notes during testing
```

Create this structure now using your file tools.

## Step 3: Generate scope.md

Create `engagement-<target>/scope.md` with the following content filled in from Step 1:

```markdown
# Engagement Scope — [Target Name]

**Date:** [Today's date]
**Tester:** [Your name]
**Type:** [Assessment type]
**Window:** [Start] to [End] [Timezone]

## In Scope
[List all in-scope targets]

## Out of Scope
[List all out-of-scope targets]

## Rules of Engagement
- Testing window: [times]
- Disruption allowed: [Yes/No]
- Production systems: [In/Out of scope]
- Emergency contact: [Name — Phone]

## Credentials
[Any provided credentials and access level]

## Notes
[Any other relevant details]
```

## Step 4: Reconnaissance Checklist

Generate a tailored recon checklist based on the scope. Include:

**Passive (no active contact with target):**
- [ ] WHOIS + reverse WHOIS on all domains
- [ ] DNS enumeration: A, MX, NS, TXT, SPF, DMARC, DKIM
- [ ] Certificate transparency search (crt.sh)
- [ ] Shodan/Censys: IP ranges and domains
- [ ] LinkedIn/OSINT: key personnel, tech stack signals
- [ ] GitHub/GitLab: exposed repos, leaked credentials
- [ ] Wayback Machine: historical URLs and content
- [ ] Google dorks: site:target.com filetype:pdf, etc.

**Active (direct contact with target — only during authorized window):**
- [ ] Nmap: full port scan all in-scope IPs
- [ ] Service fingerprinting on all open ports
- [ ] Web crawling: sitemap, robots.txt, JS source
- [ ] Directory fuzzing with ffuf
- [ ] Technology fingerprinting (whatweb, Wappalyzer)

## Step 5: Confirm Ready to Test

Summarize the engagement details and ask for explicit confirmation before proceeding to active testing. Display:

```
ENGAGEMENT SUMMARY
==================
Target:     [Name]
Type:       [Type]
Window:     [Times]
In scope:   [Summary]
Out scope:  [Summary]
Emergency:  [Contact]

Ready to begin? (yes/no)
```

Do not begin active testing without an explicit "yes" from the user.