Evidence Pack
Bundle redacted pentest evidence from YOUR lab — index, report, timeline, refusal statement.
Visual · t19_evidence_pack
Evidence pack = mentor handoff bundle from $LAB engagement. Original Cyberlium.
One indexed pack with redactions beats a folder called shells_final_DO_NOT_SHARE.
Assemble evidence pack: RoE copy, lab path diagram, post-ex timeline UTC, privesc/AD lab notes redacted, pentest report PDF, remediation table, cover-tracks refusal statement, evidence index with paths/dates/redactions. Single directory chmod 600 — index.md lists contents. Mentor copy redacts internal IPs if policy requires. No stranger scan data, no anti-forensics tools, no live hash files. Gap paragraph: planned improvements on same lab bench (MFA, segmentation lab) — not filler from unauthorized tests.
1. Pack contents
Minimum: RoE, lab path, report, remediation, timeline, refusal line, index.
Optional: enum checklist, AD literacy card from Module 7.
Command guide
Try these commands — Pack contents
═══ LINUX / KALI (Penetration Testing & Service Audit) ═══
Port scan and service banner grabbing against authorized target
Command — copy this
nmap -sV -sC -Pn -T4 -p 21,22,80,443,445,3389 ${LAB_HOST:-127.0.0.1}Enumerate web directories and hidden endpoints
Command — copy this
gobuster dir -u http://${LAB_HOST:-127.0.0.1} -w /usr/share/wordlists/dirb/common.txt -q -t 20 2>/dev/null || head -5 /etc/hostsMetasploit framework module inspection (Safe lab syntax)
Command — copy this
msfconsole -q -x "use auxiliary/scanner/portscan/tcp; set RHOSTS 127.0.0.1; set PORTS 80,443; run; exit" 2>/dev/null || echo "Run in Kali msfconsole"
═══ WINDOWS (Audit Target) ═══ Enumerate open listening ports with process mappings
Command — copy this
netstat -ano | findstr /i "LISTENING"
Primary tools to practice this lesson: nmap, curl. Reference sites: Final enum pass; MITRE (https://attack.mitre.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Index fields
Artifact name, module lesson, path, UTC date, description, redactions applied.
Cross-link checklist row to index row.
3. Integrity
Statement: no unauthorized targets, no cover-tracks techniques used.
Secure pack — no public upload of raw lab AD dumps.
4. What you ship: pentest evidence pack
Bundled deliverables + index + refusal line — chmod 600.
5. What you record before the next lesson
Evidence pack path.
6. Wrong vs right: stranger nets vs YOUR lab VMs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Add stranger pentest report PDF for 'broader coverage.'
- Right: Evidence pack assembled. Next: Capstone Lab.
Mission: assemble evidence pack
1) Bundle report path timeline RoE index. 2) Write refusal integrity line. 3) Gap paragraph; secure pack.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Minimum index rows for capstone?”
APPLY: Evidence pack includes:
APPLY: True or False: Live hashes in mentor pack OK.
APPLY: Pack integrity line states: