---
name: master-checklist
description: "THE FIRST-RUN CHECKLIST — When a new user installs RTExit or an agent starts cold, follow this checklist to set up the engagement, pick scenarios, and execute properly."
---

# RTExit Master Checklist — First Run & Every Session

> **The first thing the agent reads. The last thing the user updates.**
> Follow this from top to bottom on every new engagement or fresh agent start.

---

## Phase 0: First-Time Setup (One-Time)

### Step 0.1: Verify Docker Kali
```bash
docker ps --filter "name=rtexit-kali" --format "{{.Status}}"
# If not running:
docker start rtexit-kali
# If not exists, see the docker run command in rt-agent-commander/SKILL.md
```

### Step 0.2: Verify All Tools
```bash
docker exec -it rtexit-kali bash
/opt/rt-verify/rt-verify-all.sh
# Expected: All 200+ tools verified
```

### Step 0.3: Read Master Files
The agent MUST read these (in this order):
1. **[SOURCES-MASTER.md](SOURCES-MASTER.md)** — Where to find real CVE / Hacktivity data
2. **[TOOLS-MASTER.md](TOOLS-MASTER.md)** — What tools are available
3. **[SCENARIOS-MASTER.md](SCENARIOS-MASTER.md)** — How to map goals to scenarios
4. **[AGENT-MEMORY.md](AGENT-MEMORY.md)** — How to remember everything
5. **[END-TO-END-ENGAGEMENT.md](END-TO-END-ENGAGEMENT.md)** — A real 14-day walkthrough

### Step 0.4: Initialize Engagement Memory
```bash
# If no engagement yet:
python3 _rtexit/scripts/init-engagement.py --project-root .

# If engagement exists, just read it:
cat _rtexit-output/data/engagement-context.json | jq .
```

---

## Phase 1: Engagement Initialization

### Step 1.1: Read Authorisation (SEAD)
```bash
# Read SEAD (Statement of Engagement Authorisation Document)
cat docs/sead.md 2>/dev/null || cat _rtexit-output/data/sead.md 2>/dev/null
# If missing, RUN rt-create-sead FIRST
```

### Step 1.2: Read Scope
```bash
# Read scope document
cat docs/scope.md 2>/dev/null || cat _rtexit-output/data/scope.md 2>/dev/null
# Identify:
# - Primary domains / IP ranges
# - In-scope targets
# - Out-of-scope (NEVER touch)
# - Cloud accounts
# - Time window
# - Emergency contacts
```

### Step 1.3: Read Threat Model
```bash
cat docs/threat-model.md 2>/dev/null
# Identify:
# - Crown jewel assets
# - Threat actors (e.g., APT, ransomware, insider)
# - Likely attack scenarios
```

### Step 1.4: Update Engagement Context
```bash
# Update with client, scope, methodology
python3 _rtexit/scripts/init-engagement.py update \
  --agent "commander" \
  --field "engagement.client=Acme Corp" \
  --field "engagement.phase=recon" \
  --field "engagement.methodology=PTES"
```

---

## Phase 2: Reconnaissance (Surface Mapping)

### Step 2.1: Subdomain Enumeration
```bash
# Read rt-subdomain-enum/scenarios.md
# Pick top 3 scenarios
# Run in Docker Kali
docker exec -it rtexit-kali bash
subfinder -d target.com -all -o /opt/loot/subs_subfinder.txt
amass enum -passive -d target.com -o /opt/loot/subs_amass.txt
cat /opt/loot/subs_*.txt | sort -u > /opt/loot/subs_all.txt
```

### Step 2.2: Live Host Discovery
```bash
cat /opt/loot/subs_all.txt | httpx -status-code -title -tech-detect -o /opt/loot/live.txt
# Identify tech stack
```

### Step 2.3: Update Context
```bash
python3 _rtexit/scripts/init-engagement.py update \
  --agent "scout" \
  --field "recon.subdomains_found=47" \
  --field "recon.live_hosts=31" \
  --note "Subdomain enum + live host detection complete"
```

### Step 2.4: Continue Recon (per asset)
- Port scan (nmap) → services
- Tech detection (whatweb) → stack
- JS analysis (linkfinder, secretfinder) → endpoints/secrets
- GitHub recon (trufflehog) → leaked creds
- Cloud recon (cloudlist, S3Scanner) → buckets
- OSINT (theHarvester, h8mail) → emails

---

## Phase 3: Attack Surface Mapping

### Step 3.1: Prioritize Targets
```bash
# Update context with attack surface
python3 _rtexit/scripts/init-engagement.py update \
  --agent "scout" \
  --field "notes.attack_vectors=[\"file_upload\",\"ssrf\",\"bola\"]" \
  --field "notes.interesting_tech=[\"Apache 2.4.49\",\"Spring Boot\"]"
```

### Step 3.2: Map to Scenarios
Open **[SCENARIOS-MASTER.md](SCENARIOS-MASTER.md)** and pick relevant skills:
- LFI → `02-web/rt-path-traversal/scenarios.md`
- SSRF → `02-web/rt-exploit-ssrf/scenarios.md`
- BOLA → `03-api/rt-exploit-api/scenarios.md`
- File upload → `02-web/rt-exploit-file-upload/scenarios.md`

### Step 3.3: Read Top Scenarios
For each chosen skill, read the `scenarios.md` Index and pick the top 3-5.

---

## Phase 4: Initial Exploitation

### Step 4.1: Start Exploitation
- Begin with the **simplest, most likely** scenario
- Use the **Detection** command first
- If positive, run **Exploit**
- Then run **Chain** to escalate

### Step 4.2: Track Each Attempt
```bash
# After each scenario:
python3 _rtexit/scripts/init-engagement.py update \
  --agent "breaker" \
  --note "Tried S01 LFI on staging.acmecorp.com - SUCCESS"
```

### Step 4.3: Get Initial Foothold
Document the access:
```bash
python3 _rtexit/scripts/init-engagement.py update \
  --field "access.initial_access+={\"vector\":\"file_upload\",\"target\":\"staging\",\"method\":\"php_polyglot\"}"
```

---

## Phase 5: Document Each Finding

### Step 5.1: Use the Finding Template
```bash
# Use rt-finding-document skill
# Or directly via tracker:
python3 _rtexit/scripts/finding_tracker.py add \
  --title "Unrestricted File Upload RCE" \
  --severity "critical" \
  --target "staging.acmecorp.com" \
  --cvss 9.8 \
  --cve "CVE-XXXX-XXXXX" \
  --mitre "T1190"
```

### Step 5.2: Save Evidence
- Screenshot → `/opt/loot/findings/F-001/screenshots/`
- Request/Response → `/opt/loot/findings/F-001/requests/`
- Output → `/opt/loot/findings/F-001/output/`

---

## Phase 6: Post-Exploitation

### Step 6.1: Pivot
- Look for credentials on compromised host
- Use stolen creds on other systems
- Try AD attacks (impacket, mimikatz, certipy)
- Try cloud attacks (aws-cli, pacu)

### Step 6.2: Privilege Escalation
- Read `rt-privilege-escalation/scenarios.md`
- Read `rt-post-exploitation/scenarios.md`
- Use linpeas/winpeas

### Step 6.3: Lateral Movement
- Read `rt-lateral-movement/scenarios.md`
- impacket-psexec, wmiexec, evil-winrm
- CrackMapExec for enumeration

### Step 6.4: Update Context
After every escalation:
```bash
python3 _rtexit/scripts/init-engagement.py update \
  --field "access.privileged_access+={\"level\":\"DA\",\"system\":\"dc01\"}" \
  --field "phases.post_exploit.status=active"
```

---

## Phase 7: Active Directory / Cloud

### Step 7.1: AD
- Read `06-active-directory/rt-exploit-active-directory/scenarios.md`
- Try Zerologon (if in scope)
- AS-REP Roast → Kerberoast → DCSync
- ADCS ESC1-13

### Step 7.2: Cloud
- Read `05-cloud/rt-exploit-cloud-aws/scenarios.md`
- S3 enumeration
- IMDSv1 exploitation
- Privilege escalation with Pacu

---

## Phase 8: Reporting

### Step 8.1: Compile Findings
```bash
python3 _rtexit/scripts/finding_tracker.py list
python3 _rtexit/scripts/finding_tracker.py stats
python3 _rtexit/scripts/finding_tracker.py export --format csv
```

### Step 8.2: Generate Reports
- Executive: `rt-executive-report` skill
- Technical: `rt-technical-report` skill
- Remediation: `rt-remediation-roadmap` skill
- Compliance: `rt-compliance-mapper` skill

### Step 8.3: Final Update
```bash
python3 _rtexit/scripts/init-engagement.py update \
  --field "phases.reporting.status=complete" \
  --field "engagement.phase=closed"
```

---

## 🔍 WHEN YOU CAN'T FIND A SCENARIO (Critical Workflow)

### Step 1: Acknowledge
"I don't have a scenario for this exact case locally."

### Step 2: Search SOURCES-MASTER
Open [SOURCES-MASTER.md](SOURCES-MASTER.md) and find the right sources.

### Step 3: Run Web Searches
Use the queries from SOURCES-MASTER:
```
site:nvd.nist.gov [search-term]
site:hackerone.com [company] [vuln]
site:portswigger.net [topic]
site:github.com PoC CVE-XXXX-XXXXX
```

### Step 4: Verify Source
- Is the CVE real? Check NVD
- Is the HackerOne report disclosed? Check Hacktivity
- Is the research real? Check the URL

### Step 5: Save to Local Knowledge
```bash
mkdir -p _rtexit-output/data/intel/
cat > _rtexit-output/data/intel/CVE-XXXX-XXXXX.md << 'EOF'
# CVE-XXXX-XXXXX
**Source:** [URL]
**Verified:** [date]
**Product:** [name+version]
**Impact:** [description]
**Exploit:** [link or command]
**Detection:** [command]
**Notes:** [your analysis]
EOF
```

### Step 6: Update SOURCES-MASTER (if a new reliable source found)
Add to [SOURCES-MASTER.md](SOURCES-MASTER.md) using the template.

### Step 7: Document the Scenario
Write the scenario in the relevant `scenarios.md`:
```markdown
## SXX: [Title]
**Context:** [where it appears]
**Seen in:** [verified source]
**Impact:** [what you get]
### Detection
[command]
### Exploit
[command]
### Chain
[steps]
### Bypass / Notes
[notes]
```

---

## 📋 Master Checklist (Copy-Paste for Every New Engagement)

```markdown
# [Engagement Name] — Master Checklist

## Phase 0: Setup
- [ ] Docker Kali running (`docker ps`)
- [ ] Tools verified (`/opt/rt-verify/rt-verify-all.sh`)
- [ ] All 5 master files read

## Phase 1: Authorization
- [ ] SEAD read and understood
- [ ] Scope defined
- [ ] Threat model built
- [ ] Engagement context initialized

## Phase 2: Recon
- [ ] Subdomain enum (subfinder, amass)
- [ ] Live host detection (httpx)
- [ ] Port scan (nmap)
- [ ] Tech detection (whatweb)
- [ ] JS analysis (linkfinder, secretfinder)
- [ ] GitHub recon (trufflehog)
- [ ] OSINT (theHarvester, h8mail)
- [ ] Cloud recon (cloudlist, S3Scanner)

## Phase 3: Surface Mapping
- [ ] Context updated with attack surface
- [ ] Scenarios chosen from SCENARIOS-MASTER
- [ ] Top scenarios read

## Phase 4: Initial Exploitation
- [ ] First foothold achieved
- [ ] Documented in finding tracker
- [ ] Evidence saved

## Phase 5: Post-Exploitation
- [ ] Privilege escalation attempted
- [ ] Credentials harvested
- [ ] Lateral movement attempted

## Phase 6: AD/Cloud
- [ ] AD recon (if in scope)
- [ ] AD exploitation (Zerologon, Kerberoast, DCSync)
- [ ] Cloud exploitation (S3, IMDS, IAM)

## Phase 7: Reporting
- [ ] All findings documented
- [ ] Executive report generated
- [ ] Technical report generated
- [ ] Remediation roadmap generated
- [ ] Client debrief scheduled

## Knowledge Updates (CRITICAL)
- [ ] New CVEs saved to _rtexit-output/data/intel/
- [ ] New sources added to SOURCES-MASTER
- [ ] New scenarios added to relevant scenarios.md
- [ ] SOURCES-MASTER.md committed
```

---

## 🔄 Real-Time Updates (Agent MUST)

After every significant action, update the context:

```bash
# After every recon
python3 _rtexit/scripts/init-engagement.py update --agent "scout" --note "[action]"

# After every finding
python3 _rtexit/scripts/finding_tracker.py add [args]

# After every exploit
python3 _rtexit/scripts/init-engagement.py update --agent "breaker" --note "[action]"

# After every escalation
python3 _rtexit/scripts/init-engagement.py update --agent "phantom" --note "[action]"

# After every reporting
python3 _rtexit/scripts/init-engagement.py update --agent "scribe" --note "[action]"
```

---

## 🚀 When the User Says "Continue the Engagement"

1. Read context
2. Check phase
3. Check what's complete
4. Check what's pending
5. Resume from there
6. Update as you go

**The agent NEVER starts from zero. It always picks up where it left off.**

---

## 📚 Knowledge Growth Strategy

**This is what makes RTExit the best in the world:**

1. **Local scenarios** — 557 scenarios across 20 files (curated)
2. **Verified CVEs** — 91 NVD-verified CVEs with real payloads
3. **Sources Master** — 100+ reliable sources for when scenarios aren't enough
4. **Real-time intel** — Agent adds new CVEs to `_rtexit-output/data/intel/`
5. **Community growth** — Every engagement adds new scenarios
6. **Cross-session memory** — Engagement context persists forever
7. **No hallucination** — When unknown, search SOURCES-MASTER

**This is the RTExit way.**
