Penetration › Module 10 › Lesson 3
Evidence Pack
Bundle redacted pentest evidence from YOUR lab — index, report, timeline, refusal statement.
Visual · t19_evidence_pack
Evidence pack = mentor handoff bundle from $LAB engagement. Original Cyberlium.
Opening
One indexed pack with redactions beats a folder called shells_final_DO_NOT_SHARE.
Assemble evidence pack: RoE copy, lab path diagram, post-ex timeline UTC, privesc/AD lab notes redacted, pentest report PDF, remediation table, cover-tracks refusal statement, evidence index with paths/dates/redactions. Single directory chmod 600 — index.md lists contents. Mentor copy redacts internal IPs if policy requires. No stranger scan data, no anti-forensics tools, no live hash files. Gap paragraph: planned improvements on same lab bench (MFA, segmentation lab) — not filler from unauthorized tests.
1. Pack contents
Minimum: RoE, lab path, report, remediation, timeline, refusal line, index.
Optional: enum checklist, AD literacy card from Module 7.
Command guide
Try these commands — Pack contents
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Final enum pass — varied flags on $LAB_HOST MITRE — https://attack.mitre.org/ (techniques cited in report)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install nmap sudo apt install curl
macOS:
Command — copy this
brew install nmap
Windows:
Command — copy this
choco install nmap # or download https://nmap.org/download.html
Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
source "$HOME/cyberlium-lab/t19-lab.env" nmap -sC -sV --top-ports 25 "$LAB_HOST" | head -30 curl -sS https://attack.mitre.org/ | head -3
Primary tools to practice this lesson: nmap, curl. Reference sites: Final enum pass; MITRE (https://attack.mitre.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Index fields
Artifact name, module lesson, path, UTC date, description, redactions applied.
Cross-link checklist row to index row.
3. Integrity
Statement: no unauthorized targets, no cover-tracks techniques used.
Secure pack — no public upload of raw lab AD dumps.
4. What you ship: pentest evidence pack
Bundled deliverables + index + refusal line — chmod 600.
5. What you record before the next lesson
Evidence pack path.
6. Wrong vs right: stranger nets vs YOUR lab VMs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Add stranger pentest report PDF for 'broader coverage.'
Right
Evidence pack assembled. Next: Capstone Lab.
Mission: assemble evidence pack
1) Bundle report path timeline RoE index. 2) Write refusal integrity line. 3) Gap paragraph; secure pack.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Minimum index rows for capstone?”
Knowledge Check
APPLY: Evidence pack includes:
Multiple choice
Knowledge Check
APPLY: True or False: Live hashes in mentor pack OK.
True or False
Knowledge Check
APPLY: Pack integrity line states:
Multiple choice