Domain overview
Foundations matters because offensive work is only useful when the engagement model, authorization, evidence trail and reporting standard are precise. This domain keeps the legal, procedural and communication layer as rigorous as the technical one.
Selected public references
- pentest-standard.readthedocs.io · Latestpentest-standard.readthedocs.io/en/latest/
- csrc.nist.gov · Finalcsrc.nist.gov/pubs/sp/800/115/final
- OWASP Web Security Testing Guideowasp.org/www-project-web-security-testing-guide/
- first.org · CVSSfirst.org/cvss/
- OWASP WSTG · 5 Reportingowasp.org/www-project-web-security-testing-guide/latest/5-Reporting/
Topic index
Penetration Test Workflow
Penetration Test Workflow: assessment planning, authorization, scope control and delivery decisions that keep technical work defensible.
Why Run A Penetration Test At All?
Why Run A Penetration Test At All?: assessment planning, authorization, scope control and delivery decisions that keep technical work defensible.
Permission to Attack
Permission To Attack: engagement governance covering authorization, boundaries, evidence obligations and delivery expectations.
Pentesting Standards
Pentesting Standards: assessment planning, authorization, scope control and delivery decisions that keep technical work defensible.
How To Define Scope With The Client
How To Define Scope With The Client: engagement governance covering authorization, boundaries, evidence obligations and delivery expectations.
What Does An Nda Look Like?
What Does An Nda Look Like?: engagement governance covering authorization, boundaries, evidence obligations and delivery expectations.
Pta/Scope/Nda Filling Out
Pta/Scope/Nda Filling Out: engagement governance covering authorization, boundaries, evidence obligations and delivery expectations.
Third-Party Consent Declaration
Third-Party Consent Declaration: engagement governance covering authorization, boundaries, evidence obligations and delivery expectations.
The 7 Phases Of A Penetration Test
The 7 Phases Of A Penetration Test: assessment planning, authorization, scope control and delivery decisions that keep technical work defensible.
University: Yes Or No?
University: Yes Or No?: assessment planning, authorization, scope control and delivery decisions that keep technical work defensible.
Security Conferences: Yes Or No?
Security Conferences: Yes Or No?: assessment planning, authorization, scope control and delivery decisions that keep technical work defensible.
Pentesting Effort / Time Budget
Pentesting Effort / Time Budget: engagement governance covering authorization, boundaries, evidence obligations and delivery expectations.
Pentesting Insurance
Pentesting Insurance: assessment planning, authorization, scope control and delivery decisions that keep technical work defensible.
Taking Notes
Taking Notes: evidence structure, reproducibility and communication choices that turn technical observations into defensible findings.
eJPT - Junior Pentesting Certification
eJPT - Junior Pentesting Certification: certification scope, expected competencies and a practical route from objectives to hands-on validation.
Pentesting Certifications
Pentesting Certifications: certification scope, expected competencies and a practical route from objectives to hands-on validation.