The engagement: methodology and reporting

What this path is#

You can now find real bugs. This path is about turning that into professional work, the part that separates someone who occasionally stumbles on a finding from someone a client or a program trusts. It covers how to run an assessment as a repeatable process, how to keep notes and evidence, where the line of "allowed" is and how to stay on the right side of it, and how to write a report that a busy triager accepts on the first read. It ends with how to approach a practical exam day.

There are no labs here, on purpose: the skill is judgement and craft, not a payload. The exercises use this platform's own Programs section and public disclosed reports.

Who it is for#

• Anyone who finished the technique paths and wants to work like a professional, not just pop shells.
• Someone preparing for an entry-level web-application penetration testing exam. This path covers the processes-and-methodologies objective and the reporting the exam requires, built on the public OWASP Web Security Testing Guide. It is not affiliated with, or endorsed by, any exam vendor and uses none of their material.

The plan#

1. A repeatable methodology. Working the same reliable way every time, guided by OWASP WSTG.
2. Notes, evidence, and the harness. What to record so a finding survives to the report.
3. Scope, permission, and the honesty gate. The line that makes you a researcher, not an intruder.
4. Writing the report that survives triage. The document that decides whether your work counts.
5. Exam day and time-boxing. Turning all of this into a score under a clock.

Before you start#

Finish the technique paths (Recon, Access, Injection, Server-side), this path assumes you can find the bugs it teaches you to run an engagement around. Revisit Foundations' last lesson, "What are you allowed to test?", because scope and permission are the spine of this whole path. No tools beyond a notebook and, ideally, a look at some real disclosed reports on public bug-bounty platforms.