Real-World Pentesting Simulation
A simulation domain tests judgment, scoping, and reporting as much as exploitation. The concepts a candidate must hold: rules of engagement (RoE), scope definition (domains, IP ranges, excluded hosts), and authorization artifacts. You must understand testing windows, rate limits, and handling of production data - never exfiltrate real PII; demonstrate access and stop. Know the difference between a vulnerability, an exploit, and a business-impact narrative, and how to chain low-severity findings into a credible attack path.
Methodology matters: reconnaissance (subdomain enumeration, content discovery), then mapping the attack surface, then prioritized exploitation, then lateral movement and privilege escalation within scope, then cleanup. Evidence handling: timestamped requests/responses, reproducible steps, and screenshots that do not expose unrelated user data.
Traps in questions: assuming out-of-scope hosts are fair game because they are reachable; confusing a proof-of-concept that alters data with a safe demonstration; ignoring a client's explicit exclusion of a third-party SaaS; and treating a scanner output as a confirmed finding. Another trap is failing to note when a finding requires a precondition (authenticated user, specific role) - severity depends on that context.
Rule of thumb: if a step would change state, delete data, or touch another tenant, stop and demonstrate the capability instead. Document the precondition and the minimal proof.
Worked example: you find an SSRF that reaches an internal metadata endpoint. Instead of pulling credentials, request a harmless internal URL and record the response headers as evidence, noting the theoretical escalation path in the report.