engagement:
  name: "Q3-External-Web-App-Pentest"
  type: "Grey Box"
  scope:
    in_scope:
      - "https://app.example.com"
      - "api.example.com"
    out_of_scope:
      - "legacy.example.com"
      - "Third-party payment gateway"
  rules:
    max_bandwidth_mbps: 10
    allowed_hours: "09:00-17:00 UTC"
    data_handling: "Encrypt at rest, purge within 30 days"
  deliverables:
    - "Technical Report"
    - "Executive Summary"
    - "Remediation Playbook"
    - "Retest Validation"

#!/usr/bin/env python3
import subprocess
import json
import sys

def run_cmd(cmd):
    return subprocess.check_output(cmd, shell=True).decode().strip().split('\n')

def recon_pipeline(target):
    print(f"[*] Starting reconnaissance for {target}")
    # Subdomain enumeration
    subs = run_cmd(f"subfinder -d {target} -silent")
    print(f"[+] Found {len(subs)} subdomains")
    
    # Alive check + tech fingerprinting
    alive = run_cmd(f"echo '{chr(10).join(subs)}' | httpx -silent -status-code -tech-detect -json")
    tech_map = {}
    for line in alive:
        if line:
            data = json.loads(line)
            host = data.get('input', '')
            techs = data.get('tech', [])
            tech_map[host] = techs
            
    # Output structured recon data
    with open('recon_output.json', 'w') as f:
        json.dump(tech_map, f, indent=2)
    print("[+] Recon complete. Output saved to recon_output.json")

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print("Usage: python3 recon_pipeline.py <target-domain>")
        sys.exit(1)
    recon_pipeline(sys.argv[1])

import json

def prioritize_attack_paths(recon_data, critical_assets):
    # Assign risk scores based on exposure + sensitivity
    scores = {}
    for host, techs in recon_data.items():
        base_score = 5.0
        if any('admin' in h.lower() or 'login' in h.lower() for h in [host]):
            base_score += 2.0
        if 'database' in str(techs).lower() or 'api' in str(techs).lower():
            base_score += 1.5
        if host in critical_assets:
            base_score += 3.0
        scores[host] = round(base_score, 1)
    
    sorted_paths = sorted(scores.items(), key=lambda x: x[1], re

verse=True) print("[+] Prioritized attack paths:") for host, score in sorted_paths[:5]: print(f" {host} -> Risk Score: {score}") return sorted_paths

Usage: load recon_output.json, define critical_assets list, run function

### Phase 4: Vulnerability Validation & Exploitation
Move beyond scanner output. Validate findings manually, chain vulnerabilities, and demonstrate real-world impact without causing disruption.

**Methodology Enabler:** Controlled validation wrapper
```bash
#!/bin/bash
# validate_vuln.sh - Safe validation runner
TARGET=$1
VULN_TYPE=$2
TOOL="nuclei"

echo "[*] Validating $VULN_TYPE on $TARGET"
mkdir -p validation_logs

# Run nuclei with rate limiting and safe templates
$tool -u "$TARGET" -t "$VULN_TYPE" -rl 50 -c 5 -json -o "validation_logs/${VULN_TYPE}_$(date +%Y%m%d).json"

# Extract only confirmed matches
jq 'select(.info.severity == "critical" or .info.severity == "high")' \
  "validation_logs/${VULN_TYPE}_$(date +%Y%m%d).json" > \
  "validation_logs/${VULN_TYPE}_confirmed.json"

echo "[+] Validation complete. Confirmed findings saved."

Phase 5: Post-Exploitation & Impact Assessment

Determine what an attacker can do post-compromise. Assess data exposure, privilege escalation, lateral movement, and business impact.

Methodology Enabler: Impact enumeration checklist (automated)

def assess_impact(exploit_result, environment_context):
    impact = {
        "data_exposure": False,
        "privilege_escalation": False,
        "lateral_movement": False,
        "business_continuity": "Unknown"
    }
    
    if "db_credentials" in exploit_result or "s3_bucket" in exploit_result:
        impact["data_exposure"] = True
    if "root" in exploit_result or "admin" in exploit_result:
        impact["privilege_escalation"] = True
    if "internal_subnet" in environment_context or "domain_controller" in exploit_result:
        impact["lateral_movement"] = True
        
    # Map to business impact
    if impact["data_exposure"] and impact["privilege_escalation"]:
        impact["business_continuity"] = "High - Potential data breach + full control"
    elif impact["lateral_movement"]:
        impact["business_continuity"] = "Medium - Network pivot risk"
    else:
        impact["business_continuity"] = "Low - Isolated compromise"
        
    return impact

Phase 6: Reporting & Remediation Guidance

Deliver actionable intelligence. Structure findings by risk, provide reproduction steps, business context, and prioritized remediation paths.

Methodology Enabler: Report generation template

{
  "finding_id": "PENT-2024-042",
  "title": "Unauthenticated API Endpoint Exposes User PII",
  "severity": "Critical",
  "cvss_v3": "9.8",
  "business_context": "Exposes customer names, emails, and phone numbers to unauthenticated attackers",
  "reproduction_steps": [
    "1. Send GET request to /api/v1/users/export",
    "2. Observe JSON response containing unredacted PII",
    "3. No authentication or rate limiting enforced"
  ],
  "remediation": {
    "short_term": "Implement JWT authentication + IP allowlisting",
    "long_term": "Adopt API gateway with WAF, enforce data minimization",
    "owner": "Backend Engineering",
    "sla_days": 7
  },
  "validation_status": "Confirmed via manual testing"
}

---

Pitfall Guide (6 Critical Mistakes)

1. Over-Reliance on Automated Scanners Why it happens: Teams treat scanner output as definitive findings. Impact: High false positives, missed logic flaws, and CVE-chaining blind spots. Fix: Enforce manual validation for every critical/high finding. Use scanners for coverage, not conclusion.

2. Inadequate Rules of Engagement (RoE) Why it happens: Scoping is rushed or legally vague. Impact: Unauthorized access, service disruption, or legal exposure. Fix: Document RoE explicitly: time windows, rate limits, out-of-scope assets, emergency kill-switch procedures, and authorized contacts.

3. Ignoring Business Context Why it happens: Findings are reported with CVSS scores but no business mapping. Impact: Remediation teams deprioritize critical issues that don't align with operational reality. Fix: Tie every finding to data sensitivity, system criticality, and regulatory exposure. Use impact scoring over technical scoring alone.

4. Skipping Post-Exploitation Validation Why it happens: Teams stop at initial compromise to "save time" or avoid risk. Impact: Underestimation of real-world attack paths and lateral movement potential. Fix: Define post-exploitation boundaries in RoE. Always assess privilege escalation, data access, and network pivot capability within agreed limits.

5. Poor Chain of Custody & Documentation Why it happens: Evidence is scattered across notes, screenshots, and CLI outputs. Impact: Unverifiable findings, failed audits, and inability to retest accurately. Fix: Log every command, timestamp outputs, hash collected evidence, and maintain a centralized engagement journal. Use structured JSON/YAML for reproducibility.

6. Treating Pentesting as a One-Time Event Why it happens: Budget constraints or compliance mindset drive annual testing. Impact: Drift between assessment and production reality; new vulnerabilities emerge immediately. Fix: Shift to continuous validation. Integrate pentest findings into CI/CD, schedule quarterly retests, and automate regression checks for critical paths.

---

Production Bundle

✅ Pre-Engagement Checklist

• Signed Rules of Engagement & NDA
• Explicit in-scope/out-of-scope asset list
• Authorized testing windows & rate limits defined
• Emergency contact & kill-switch procedure documented
• Data handling & retention policy agreed
• Toolchain approved (no unauthorized binaries)
• Baseline system state & backup verification
• Reporting format & SLA expectations aligned
• Legal/compliance sign-off (GDPR, HIPAA, PCI, etc.)
• Test account credentials (for grey/white box) provisioned securely

📊 Decision Matrix: Pentest Type Selection

Scenario	Recommended Type	Why
External web application	Grey Box	Balances realism with efficiency; simulates authenticated attacker
Internal network / Active Directory	Black Box	Tests detection/response without insider knowledge
Cloud infrastructure (AWS/Azure)	White Box	Requires IAM roles, architecture docs, and config access for accuracy
API / Microservices	Grey Box	Needs token flows, schema access, and rate limit context
IoT / Embedded firmware	White Box	Requires hardware access, debug ports, and source/binaries
Compliance-driven (PCI-DSS, SOC2)	Black/Grey Box	Must align with specific control requirements & audit scope
Red Team / Adversary Simulation	Black Box	Full TTP simulation, multi-vector, long-duration, stealth-focused

⚙️ Config Template: pentest_engagement.json

{
  "engagement_id": "ENG-2024-089",
  "client": "Acme Corp",
  "lead_assessor": "j.doe@securityfirm.com",
  "environment": "production",
  "scope": {
    "targets": ["https://portal.acme.com", "api.acme.com"],
    "exclusions": ["payment.acme.com", "legacy.acme.com"],
    "data_classification": "PII + Financial"
  },
  "methodology": "Codcompass 2.0",
  "tools_approved": ["nmap", "burpsuite", "nuclei", "subfinder", "httpx", "sqlmap"],
  "rate_limits": {
    "requests_per_second": 10,
    "concurrent_threads": 5,
    "bandwidth_cap_mbps": 15
  },
  "reporting": {
    "format": "JSON + PDF",
    "severity_model": "CVSS v3.1 + Business Impact",
    "remediation_sla": "Critical: 7d, High: 14d, Medium: 30d"
  },
  "emergency_contact": "+1-555-0199",
  "kill_switch_trigger": "Service degradation > 15% or PII exfiltration detected"
}

🚀 Quick Start: 5-Step Launch Guide

1. Define Scope & RoE
   Document targets, exclusions, testing windows, rate limits, and emergency procedures. Obtain legal sign-off.

2. Initialize Toolchain
   Deploy the recon pipeline, configure nuclei templates, set up Burp Suite project, and verify connectivity to in-scope assets.

3. Execute Recon & Threat Model
   Run automated enumeration, validate live assets, map attack paths, and prioritize targets using the scoring script.

4. Validate & Exploit Safely
   Test vulnerabilities manually, chain exploits where applicable, document proof-of-concept steps, and assess post-exploitation impact within RoE boundaries.

5. Report & Retest
   Generate structured findings with business context, assign remediation owners, track SLA compliance, and schedule automated regression validation for critical paths.

---

Final Notes

Penetration testing is not hacking; it's engineered security validation. The Codcompass 2.0 methodology replaces guesswork with structure, automation with verification, and technical noise with business-aligned risk intelligence. By adopting phased execution, enforced validation, contextual reporting, and continuous retesting, organizations transform pentesting from a compliance exercise into a strategic risk reduction engine.

Implement this framework, enforce discipline over speed, and let methodology drive mastery. The attack surface will keep evolving; your validation process must evolve faster.