OPSECTLAS you are here: What to Record
playbook

What to Record

7 checklists what to capture at every step, so nothing is lost and the report is already half-written

The rest of the atlas tells you how to attack. This is the other half: what to write down while you do it. Capture these as you go, not from memory at the end, and the evidence, the access, and the proof survive the engagement.

  1. 01
    Before you touch anything get it in writing
    • The exact scope: in-scope IPs, ranges, domains, URLs, and apps. And in writing, what is explicitly OUT of scope.
    • Signed authorization and the rules of engagement: the dates, the hours, and the methods you are permitted to use.
    • Your points of contact and the escalation path: who to call the moment something breaks or a critical finding lands.
    • The constraints: no-go actions, fragile hosts, maintenance windows, and anything you must not touch.
  2. 02
    Every host the map
    • IP and hostname, and how they map to each other.
    • Operating system and version, and which segment or pivot you can reach it from.
    • Every open port, with the service and its exact version.
    • Anything already exposed without auth: shares, panels, directory listings, default pages.
  3. 03
    Every credential the keys
    • The credential itself and its type: a username with a password, an NTLM hash, a Kerberos ticket, an API key.
    • Where it came from: the host, file, dump, or capture that handed it to you.
    • Where it works: every host or service it validated against, and the privilege it grants.
    • Whether it is reused anywhere else. One password across hosts is a finding on its own.
  4. 04
    Access and movement the path
    • How you got each foothold: the exact vulnerability or credential, with the command that worked.
    • The privilege escalation on each host: from which user, to which, and through what.
    • Lateral movement: source, destination, method, and the credential used for each hop.
    • A running timeline: the moment you gained each new level of access.
  5. 05
    Findings and evidence the report writes itself
    • The vulnerability, the affected asset, and a severity you can defend.
    • Reproduction: the exact steps, requests, and commands, so someone else can repeat it cold.
    • Proof of impact: output or a screenshot that shows it is real (whoami, hostname, the flag, the record you could read).
    • A timestamp on every action that touched a target: date, time, and your source IP.
  6. 06
    Cleanup and artifacts leave nothing behind
    • Every file you dropped, with its full path and host.
    • Every account, service, scheduled task, or implant you created.
    • Every configuration you changed, and how to revert it.
    • A final pass confirming all of it is gone. Nothing you introduced should outlive the engagement.
  7. 07
    For the report the deliverable
    • One line of business impact per finding, in the language the client actually cares about.
    • Concrete remediation, not just "apply patches": the specific change that closes it.
    • The timeline of the engagement, and the scope you actually covered.
    • What you could not reach or test, so the gaps are honest and on the record.