Capstone: Full Lab Pentest & Report

Run an end-to-end assessment on a legal lab and write the report.

Video tutorialTrack course · freeCodeCamp

Ethical Hacking & Web Security Full Course

Speed

0.75x1x1.25x1.5x2x

Skip intro

Watch 00:00 · 2 checkpoints Watch on YouTube More on this topic

Transcript & captions .txt

11/11

1. 00:00Capstone: Full Lab Pentest & Report. Run an end-to-end assessment on a legal lab and write the report.
2. 00:07Deploy OWASP Juice Shop (or DVWA) locally, then run a complete assessment against it: recon, authentication, access control, injection, XSS, and business logic.
3. 00:16Document everything as you go.
4. 00:21Executive summary - plain language risk overview.
5. 00:26Scope and methodology - what was tested and how.
6. 00:31Findings - one per issue: title, severity, affected endpoint, reproduction steps, evidence, impact.
7. 00:36Remediation - a concrete code or configuration fix for each finding.
8. 00:41Appendix - tooling, timestamps, and out-of-scope observations.
9. 00:46Reference table: Severity, Rough criteria.
10. 00:51Build a findings tracker — edit the sample and run it in the browser.
11. 00:56Note: A finding without clear reproduction steps and a suggested fix is not actionable. Write for the developer who has to patch it.

Deploy OWASP Juice Shop (or DVWA) locally, then run a complete assessment against it: recon, authentication, access control, injection, XSS, and business logic. Document everything as you go.

• Executive summary - plain language risk overview.
• Scope and methodology - what was tested and how.
• Findings - one per issue: title, severity, affected endpoint, reproduction steps, evidence, impact.
• Remediation - a concrete code or configuration fix for each finding.
• Appendix - tooling, timestamps, and out-of-scope observations.