Lion Cipher Lab
Measure penetration test coverage against the signed scope
- Penetration Testing / Red Team
- Intermediate
- ~40 min
- Free · no account required
Why it matters
Scope is what you were allowed to test. Coverage is what you actually tested. They are often very different, and reports rarely say so. A two-week test of a /24 network with a web portal can easily spend most of its time on a few interesting hosts and never touch the rest. If the report then says 'the internal server network was tested', the client believes hosts were examined that nobody looked at. NIST SP 800-115 expects test reports to describe what was tested and any limitations, and the PCI Security Standards Council's penetration testing guidance asks for the scope as tested to be…
What you'll learn
- the difference between scope and coverage
- joining scope, discovered hosts and the activity log
- measuring breadth and depth of testing
- catching out-of-scope activity after the fact
- writing an honest coverage statement for the report
- what coverage numbers cannot show
- using coverage mid-engagement to replan
Steps in this lab
- Scope versus coverage
- The engagement data
- Write the coverage script
- Run it and read the coverage
- Write the coverage statement, and know its limits