Chapter 29 — Capstone build | Technologist Authorized offensive security and red team

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 29 published. Map, example, EX085.

flowchart TD
  N0["Learning outcomes"]
  N1["29.1 The build artefacts"]
  N2["29.2 Operate what you built"]
  N3["29.3 No exploit content"]
  N4["29.4 Peer review rubric"]
  N5["29.5 Time box"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
  N6 --> EX["Worked example"]
  EX --> Q["Exercise EX085"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["29.1 The build artefacts"]
  N2["29.2 Operate what you built"]
  N3["29.3 No exploit content"]
  N4["29.4 Peer review rubric"]
  N5["29.5 Time box"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX085"]

[Learning outcomes]
    |
    v
[29.1 The build artefacts]
    |
    v
[29.2 Operate what you built]
    |
    v
[29.3 No exploit content]
    |
    v
[29.4 Peer review rubric]
    |
    v
[29.5 Time box]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX085]

Learning outcomes

You will (1) assemble an end-to-end authorized assessment package for a synthetic TRT request; (2) include scope objects, ROE, method statement, evidence plan, rating scale and report template; (3) run every lab checker against the package; (4) submit a build that a peer can operate without asking you questions.

29.1 The build artefacts

Request and decision statement. 2. Scope lists (prefixes, names, exclusions). 3. ROE (window, allowed activities, stop list, white-team contact). 4. Method statement mapped to SP 800-115/PTES/WSTG as used. 5. Kit inventory with versions. 6. Evidence plan (what, where, retention). 7. Rating scale and bands. 8. Report template with executive table hook. 9. Retest plan. 10. Evaluation criteria.

Missing any one of the ten fails the capstone completeness score. The order follows the life of an engagement, so the completeness score walks the artefacts in the same sequence on the peer score sheet. A package with sparkling findings but no evidence plan or retest plan is incomplete. In Priya's worked example every one of the ten artefacts is present, including exclusion of fare-payment by both prefix and hostname.

29.2 Operate what you built

A peer loads your scope into lab_scope.py patterns, your ROE into lab_roe.py patterns, and your findings into lab_score.py and lab_report.py. If they cannot, the build is incomplete.

In the worked example a peer runs the checkers on Priya's package and gets the same STOP and IN-SCOPE results she documented. That reproduction by someone other than the author is what operability means here. If the scope checker cannot load the submitted lists, operability fails before any slide is looked at, because a polished presentation of an unusable package does not help an operations team.

29.3 No exploit content

The package contains zero attack procedures. Anyone asking for them during the capstone is redirected to the educational boundary in Chapter 10.

The capstone tests whether students can design and run an assessment service, not whether they can attack something, so attack steps add nothing to the grade. A student who asks for exploit detail during the build is redirected to Chapter 10 and receives a safety deduction. The rubric has no exception for requests framed as being for teaching purposes, since a written procedure works the same way whoever reads it later.

29.4 Peer review rubric

Peers score: completeness of the ten artefacts, checkability, clarity of residual-risk language, and safety (no dual-use detail). Finding volume is irrelevant.

Dual-use detail fails the safety criterion even in an otherwise complete package. A peer who awards extra marks for a long findings list has invented a criterion, and that score sheet is voided and redone. The point of the rubric is that a reviewer could hand the package to an operations team and expect it to work, with residual-risk wording that a manager can repeat accurately.

29.5 Time box

The capstone build is scored on completeness and operability inside a fixed studio window, not on endless polish. Priya freezes scope lists forty-eight hours before peer review so checkers stop moving. Last-minute aesthetic edits that break a CSV column fail the peer test.

The lead announces the freeze in the studio channel at T minus 48 hours, and after that point the scope lists are not edited. A column renamed for neatness after the freeze can stop the scope checker loading the CSV, which would fail the peer test. Polishing the slides is still allowed, provided the files the checkers read do not change.

Worked example

Priya's capstone package for a synthetic "staff-portal identity assurance" request fills all ten artefacts, excludes fare-payment by prefix and hostname, pins three tools, and includes the Chapter 22 table hook. A peer runs the checkers and produces the same STOP/IN-SCOPE results she documented.

Synthetic case. The capstone request and peer are invented.

Errors and limits

Beautiful prose that a checker cannot load fails the technologist outcome. Copying another team's package without understanding it fails too.

Exercises

EX085 — Ten artefacts. List any eight of the ten build artefacts.
Show marking criteria
Rubric: 3 = eight correct from the chapter list; 2 = five; 1 = three; 0 = none.
EX086 — Peer test. What two outcomes prove a peer can operate your package?
Show marking criteria
Rubric: 3 = checkers run + matching documented verdicts; 2 = one; 1 = peer likes the prose; 0 = none.
EX087 — Safety fail. A teammate adds a page of password-spraying steps "for realism". What do you do?
Show marking criteria
Rubric: 3 = remove; cite educational boundary; refuse dual-use content; 2 = move to appendix; 1 = keep; 0 = none.

Synthesis

Build the whole service on paper and in checkers; let a peer run it; keep exploit detail out.

Continue studying — chapter 29 of 30

← Chapter 28 (draft) · Course chapter index · Chapter 30 (draft) →