Penetration Test Planner

Plan and scope penetration testing engagements for web applications, networks, and infrastructure. Creates comprehensive test plans with methodology, scope, and reporting frameworks.

Usage

Describe the target system, testing objectives, and constraints. The planner creates a structured engagement plan with scope boundaries, testing phases, tool recommendations, and reporting templates.

Parameters

• Target: Web application, Network/infrastructure, Mobile app, API, or Cloud environment
• Type: Black box, Gray box, or White box testing
• Standard: OWASP, PTES, NIST, or Custom methodology
• Scope: Single application, Full environment, or Specific component

Examples

1. Web Application Pentest: Scope and methodology for testing an e-commerce platform — authentication testing, payment flow analysis, file upload testing, and business logic abuse scenarios.

1. Internal Network Assessment: Plan for testing internal network security — discovery phase, privilege escalation paths, lateral movement testing, and Active Directory attack scenarios.

1. Cloud Infrastructure Review: AWS/Azure security assessment plan covering IAM policies, S3/Blob permissions, network security groups, serverless function analysis, and logging gaps.

1. API Security Test: Focused assessment of a REST API with authentication bypass attempts, BOLA/IDOR testing, rate limit abuse, and injection testing across all endpoints.

Guidelines

• Scope documents clearly define what is and is not authorized for testing
• Rules of engagement specify testing windows, emergency contacts, and stop conditions
• Methodology follows recognized frameworks (PTES, OWASP Testing Guide)
• Testing phases are ordered: Reconnaissance → Scanning → Exploitation → Post-exploitation → Reporting
• Tool recommendations are specific to each phase and target type
• Legal considerations and authorization requirements are addressed upfront
• Finding severity uses CVSS scoring with business context for prioritization
• Report templates include executive summary, technical details, and remediation timeline
• Retesting procedures verify fixes actually resolve the identified vulnerabilities
• Ethical boundaries are clearly defined — this is for authorized testing only