Final Assessment

Prepare the complete lab environment for the capstone

Before starting the capstone, ensure all VMs are running and communicating correctly: Kali Linux (your attack machine) and Metasploitable 2 (your primary target). Verify network connectivity between all machines using ping, and take snapshots of all VMs labeled Capstone Start — if you accidentally break something during the exercise, you can revert without losing progress. Also prepare your documentation system: open CherryTree or your note-taking tool and create a new node for the capstone engagement with all the standard sections ready. Treat this capstone exactly as you would a real client engagement — the habits you build here will carry forward into professional work.

ping 192.168.56.101

Execute the complete reconnaissance phase

Apply the full reconnaissance methodology as if this were a real engagement: start with passive recon using whois and DNS enumeration, then move to active recon with a host discovery sweep followed by a targeted Nmap scan of the top 1000 ports. Run a full port scan in the background while you investigate the initial scan results — do not wait for the full scan to complete before starting your research. Document every finding in your notes as you go, not at the end — the goal is to build a complete picture of the target before touching any exploit. Time yourself: professional penetration testers typically spend 20-30% of their total engagement time on reconnaissance.

sudo nmap -sV -p 1-1000 192.168.56.101 && sudo nmap -A -p- -oA capstone-full 192.168.56.101 &

Build and execute a prioritized attack plan

Review all your reconnaissance findings and create a prioritized attack plan listing every potential attack vector with: the vulnerability name, CVE number if applicable, the Metasploit module or manual technique you will use, the expected access level, and the reliability rating. Prioritize by: (1) Excellent-rated Metasploit modules against known vulnerable versions, (2) web application vulnerabilities, (3) brute force attacks against services with default credentials. Work through the list systematically, documenting each attempt. Aim to achieve at least four different types of access to demonstrate breadth of exploitation skills.

searchsploit --nmap capstone-full.xml

Perform thorough post-exploitation on each compromised system

For each successful compromise, run the complete post-exploitation enumeration checklist before moving on to the next target. Use Metasploit post modules to automate much of this: local_exploit_suggester identifies privilege escalation paths, hashdump extracts password hashes, and enum_system gathers system information. For any credentials found (password hashes, plaintext passwords, SSH keys), attempt to use them on other services — credential reuse is extremely common and often allows lateral movement to additional systems. Document every credential found, every sensitive file accessed, and every additional system discovered.

use post/multi/recon/local_exploit_suggester
use post/linux/gather/hashdump

Attempt privilege escalation on all compromised systems

For any system where you have user-level access, work through the privilege escalation checklist: check sudo permissions (sudo -l), find SUID binaries (find / -perm -4000), look for writable cron jobs (ls -la /etc/cron*), check for world-writable files in sensitive locations, and research the kernel version for known exploits. On Metasploitable, the nmap SUID binary is a classic escalation path — if nmap is SUID root and is an older version, you can use its interactive mode to spawn a root shell. Document every escalation attempt including failed ones, because they show the client what an attacker tried and help demonstrate the thoroughness of your testing.

sudo -l && find / -perm -4000 -type f 2>/dev/null && uname -r

Write a complete professional penetration test report

Compile all your findings into a professional report using the template from the Report Writing lesson. The capstone report should include: an Executive Summary describing the overall risk level and top three findings, a Scope and Methodology section, a complete Attack Narrative telling the story of the engagement from initial recon to root access, individual Finding sections for each vulnerability (minimum 5 findings), a Risk Matrix showing all findings plotted by likelihood and impact, and a Remediation Roadmap prioritizing fixes by risk level. This report is your portfolio piece — it demonstrates to future employers or clients that you can conduct a complete penetration test and communicate findings professionally. Spend as much time on the report as you did on the technical testing.