An OSCP-style, end-to-end authorized pentest engagement: recon, foothold, privesc, and pivot
Authorized internal penetration test against Vantage Dynamics' fictional lab range (10.10.14[.]0/24) under a signed Rules of Engagement. Enumerate the perimeter, gain a foothold on the exposed web/app host, escalate to root, then pivot to an internal host using recovered credentials.
Authorized internal penetration test against Solace Robotics' fictional engineering VLAN (10.20.4[.]0/24) under a signed Rules of Engagement. A default nmap sweep reports the one in-scope target host as down; disabling host discovery reveals it was up the whole time. Recover credentials from an anonymously-readable share, escalate to SYSTEM, and pivot using the organization's own reused provisioning credential.
Authorized external web application penetration test against Meridian Freight's fictional partner portal (198.51.100[.]40) under a signed Rules of Engagement covering the external host and a named internal range. A version-banner vulnerability scan flags the web server as vulnerable, but the exact package build already carries a backported fix. The real entry point is an exposed .git directory whose history still holds a credential its own developers thought they had removed.
Authorized internal penetration test against Atlas Reinsurance's fictional core network (10.30.0[.]0/24) under a signed Rules of Engagement that explicitly excludes a third-party co-insurer's peered network. A default SNMP community string exposes a core device's configuration; the device's own routing table reveals a live path to the excluded partner network, which must be reported and left untouched.
Authorized internal Active Directory penetration test against Ferrous Metals Co's fictional domain (FERROUS.local, 10.40.0[.]0/24) under a signed Rules of Engagement. AS-REP roasting turns up several accounts with Kerberos pre-authentication disabled - one of them is a monitored decoy account planted specifically to catch this technique. Recover a real service account through Kerberoasting instead, then escalate using a credential still sitting in a Group Policy Preferences file in SYSVOL.