Source: Juni_2026_Exams/Penetration_Testing/checklists/pentest-ctf-exam-checklist.md

Penetration Testing CTF Checklist

Before Starting

• [ ] Confirm the authorized target and scope
• [ ] Launch the CTF with the supplied command
• [ ] Create scans/, web/, loot/, and a flag table
• [ ] Record the required flag format

Initial Enumeration

• [ ] Scan all TCP ports
• [ ] Run versions and targeted default scripts on open ports
• [ ] Record every port, including unusual high ports
• [ ] Consider a targeted UDP scan if the task suggests UDP

Web

• [ ] Read headers and HTML source
• [ ] Check robots.txt
• [ ] Inspect linked JavaScript and API endpoints
• [ ] Visit every discovered hidden path
• [ ] Download and inspect images/files with file, exiftool, and strings
• [ ] Decode Base64 and hexadecimal values
• [ ] Test only the deliberately vulnerable parameters

Services

• [ ] Connect with nc to every unknown/text service
• [ ] Check FTP banner, anonymous login, and files
• [ ] Check supplied or discovered SSH credentials
• [ ] Enumerate database names, tables, and challenge rows
• [ ] Save successful credentials and where they came from

Metasploit

• [ ] Confirm product and version
• [ ] Read module info
• [ ] Set the actual target and port
• [ ] Review all required options
• [ ] Run check when available
• [ ] Record session and privilege evidence

Shell and Pivot

• [ ] Run id, hostname, ip addr, and ip route
• [ ] Check listeners with ss -lntup
• [ ] Identify any additional authorized subnet
• [ ] Discover internal hosts
• [ ] Scan every internal host and unusual port
• [ ] Reapply web, banner, file, and decoding checks internally

Time Control

• [ ] Collect quick source/header/banner/file flags first
• [ ] Limit time on one exploit or brute-force attempt
• [ ] Recheck untested ports when stuck
• [ ] Recheck encoded values and internal routes

Submission

• [ ] Every label uses FLAG_XX
• [ ] Every value is exactly 32 hexadecimal characters
• [ ] Encoded values were decoded before submission
• [ ] No extra punctuation or whitespace was copied
• [ ] Each flag has a command or screenshot proving its source
• [ ] No guessed historical credential or flag is reported as observed