Use this as a checklist mindset while working through labs. Prefer official standards and your community session notes over any single external guide. Pair with the OWASP Web Security Testing Guide.
Engagement phases
- Scope & rules of engagement — targets, exclusions, time windows, data handling, emergency contacts.
- Reconnaissance — passive then active; keep notes of every hostname, IP, and tech fingerprint.
- Threat modeling — likely misuse cases for the business, not only CVE chasing.
- Exploitation (authorized) — prove impact with minimal force; stop at agreed boundaries.
- Post-exploitation (if in scope) — demonstrate risk without destroying systems or exfiltrating real PII.
- Reporting — findings with severity, evidence, reproduction steps, and practical remediations.
Reporting habits that help defenders
- One finding = one clear risk statement + evidence + fix guidance.
- Separate vulnerability existence from exploitability and business impact.
- Include false-path notes: what you tried that did not work.
Ethics reminder
Only test systems you are explicitly authorized to assess. Lab platforms and CTFs are for skill building; production testing without written permission is illegal.
methodologyreportingfoundations
Published 1 Oct 2026. External links open destinations outside CyberCrew — verify them before use in workshops.