Pentest Plan

---
description: Plan penetration testing scope, methodology, and rules of engagement
---

# Penetration Test Plan

Plan penetration testing for "$ARGUMENTS" covering test type, scope, methodology, rules of engagement, success criteria, and reporting requirements.

## Process

1. **Define penetration test type:**
   - **Black box** — testers have no prior knowledge of the target (simulates external attacker)
   - **Grey box** — testers have partial knowledge (user credentials, architecture docs, API documentation)
   - **White box** — testers have full knowledge (source code, architecture, admin access)
   - Select type based on testing objectives: black box for external threat simulation, grey box for authenticated attack paths, white box for comprehensive coverage
   - Document rationale for selected approach

2. **Define scope:**
   - **In-scope systems** — list specific applications, APIs, networks, hosts, and cloud resources to test
   - **In-scope test types** — network penetration, web application, API, mobile, social engineering, physical
   - **Out-of-scope systems** — explicitly list systems, networks, or techniques that are excluded
   - **Data constraints** — define handling of any sensitive data encountered during testing
   - **Third-party systems** — identify any third-party systems in scope and confirm authorization
   - Document scope boundaries clearly to prevent unauthorized testing

3. **Select methodology:**
   - **OWASP Testing Guide** — for web application and API testing
   - **PTES (Penetration Testing Execution Standard)** — for comprehensive network and application testing
   - **NIST SP 800-115** — for government and regulated environments
   - **OWASP Mobile Security Testing Guide** — for mobile application testing
   - Define testing phases: reconnaissance, scanning, exploitation, post-exploitation, reporting
   - Specify tools permitted and prohibited (if any restrictions apply)

4. **Define rules of engagement:**
   - **Testing windows** — permitted hours and days (business hours only, after hours, weekends)
   - **Notification** — who is aware testing is occurring (security team, SOC, management)
   - **Emergency contacts** — who to call if testing causes an outage or discovers active breach
   - **Prohibited techniques** — denial of service (unless explicitly authorized), social engineering of specific individuals, physical intrusion (unless in scope)
   - **Data handling** — no exfiltration of real customer data, test data only, secure deletion after testing
   - **Credential handling** — obtained credentials must be reported immediately and not reused outside testing
   - **Communication channel** — encrypted channel for reporting critical findings during testing
   - **Stop conditions** — circumstances that require immediate cessation of testing

5. **Define success criteria:**
   - What constitutes a successful test? (comprehensive coverage, critical findings identified, defense validation)
   - Minimum coverage requirements (percentage of in-scope systems tested, OWASP categories covered)
   - Expected deliverables: executive summary, technical findings, evidence (screenshots, logs), remediation recommendations
   - Finding severity classification aligned with organization's risk framework

6. **Define reporting requirements:**
   - **Executive summary** — non-technical overview for leadership
   - **Technical findings** — detailed vulnerability descriptions with CVSS scores
   - **Evidence** — proof-of-concept details, screenshots, reproduction steps
   - **Risk rating** — severity aligned with CVSS and business context
   - **Remediation recommendations** — specific, actionable guidance per finding
   - **Retest plan** — scope and timeline for verifying remediation
   - Report delivery: encrypted, limited distribution, defined retention period

7. **Set remediation timeline expectations:**
   - **Critical findings** — remediation within 72 hours, retest within 1 week
   - **High findings** — remediation within 2 weeks, retest within 1 month
   - **Medium findings** — remediation within 1 month, retest within next scheduled test
   - **Low/informational** — remediation within 1 quarter, tracked in vulnerability management
   - Define escalation process for overdue remediation

8. **Define tester qualifications:**
   - Required certifications (OSCP, CEH, GPEN, CREST, or equivalent)
   - Industry experience requirements (years, relevant sectors)
   - Background check and NDA requirements
   - Insurance requirements (professional liability, cyber insurance)
   - Preference for testers with experience in the organization's technology stack

9. **Write the artifact** to `.metapowers/security/$ARGUMENTS/pentest-plan.md` with heading:

   ## Penetration Test Plan

   Include sections:
   - **Test Type** — selected approach with rationale
   - **Scope** — in-scope and out-of-scope systems and test types
   - **Methodology** — selected testing standard and phases
   - **Rules of Engagement** — testing windows, contacts, prohibited techniques, and stop conditions
   - **Success Criteria** — coverage requirements and expected deliverables
   - **Reporting Requirements** — report structure, severity classification, and distribution
   - **Remediation Timeline** — expected fix timelines per severity level
   - **Tester Qualifications** — certification, experience, and contractual requirements

## Output

The penetration test plan written to `.metapowers/security/$ARGUMENTS/pentest-plan.md`. Present a summary to the user highlighting:
- Test type and scope definition
- Key rules of engagement and prohibited techniques
- Reporting and remediation timeline expectations
- Tester qualification requirements