How I Run a VAPT Project End to End
This is the real shape of a VAPT engagement from my side of the table — not a certification checklist. Every phase below has produced findings on live projects; the box at the end shows a sanitized, representative slice of what those findings look like.
1. Scope and rules of engagement
Nothing starts before the scope, testing window, excluded systems, and escalation contacts are in writing. I confirm IP ranges are owned by the client, agree on whether social engineering and DoS-style tests are in or out, and set a 'stop and call' threshold for anything that looks like real production impact.
2. Recon and discovery
Passive first, then active. The goal is an accurate asset and service picture before a single exploit.
- OSINT: certificate transparency, DNS, breach data for valid usernames and password patterns
- Staged Nmap: host sweep, full SYN scan with `--min-rate`, then `-sV -sC` on open ports only
- Credentialed Nessus scan with DoS plugins disabled; triage to Exploitable + CVSS >= 7
- Map the AD picture early — domains, trusts, high-value groups
3. Exploitation
I prove impact, not just presence. A CVSS number in a scanner is a lead; a shell, a token, or exfiltrated data is a finding.
- Validate scanner hits manually before they go anywhere near the report
- Chain low-severity issues — an info leak plus weak creds is often a Critical path
- Keep a clean log of every command with timestamps for the report and for cleanup
4. Post-exploitation and lateral movement
From first foothold I look for credentials in memory and on disk, then pivot. BloodHound turns a messy AD into a shortest-path-to-Domain-Admin graph; most internal engagements are won on ACL abuse and misused service accounts, not memory-corruption exploits.
5. Reporting and retest
Each finding gets: a sanitized reproduction, business impact in plain language, severity with justification, and a fix plus a detection rule. Then I retest after remediation and issue a delta report — an unverified fix is not a fixed finding.
What this kind of project turns up
Representative findings from real engagements. Details are altered and unlinked from any client — the pattern and severity are what matter.
Outdated collaboration software missing a known patch (CVE class: OGNL injection). Single request to a shell as the service account; used as the initial foothold.
A helpdesk group held GenericWrite over a Tier-0 account. BloodHound-mapped, exploited with a targeted Kerberoast + delegation abuse chain. No CVE — pure misconfiguration.
Enabled an NTLM relay path from a coerced authentication (PetitPotam-style) to privileged systems.
Two SPNs cracked offline within an hour of Kerberoasting. Rotated to gMSA in remediation.
Useful for an attacker's mapping phase; low direct impact. Fixed with a generic error handler.
Tools mentioned
A VAPT project is a chain-building exercise wrapped in disciplined scoping and reporting. The scanner finds leads; you prove the path, and every finding leaves behind both a fix and a detection.