🛡️
BankInReach Pentest
1 Recon 🔒
2 Scan 🔒
3 Exploit 🔒
4 Persist 🔒
5 Report 🔒
Detection Risk 0%
Phase Authorization

Scanning

Connecting target intelligence to next step...

ENTER CLEARANCE CODE:
🎉

MISSION COMPLETE

Congrats, Hacker!

Vulnerabilities documented & reported ethically.

🛡️

BankInReach Pentest

What is Penetration Testing? An authorized, simulated cyber attack on a computer system to identify vulnerabilities and fix security weaknesses before malicious hackers can exploit them.
The 5 Phases of Penetration Testing:
  • 1. Reconnaissance: Gathering public intelligence and mapping digital assets.
  • 2. Scanning: Probing open network ports and discovering service vulnerabilities.
  • 3. Gaining Access: Exploiting software flaws to penetrate internal servers.
  • 4. Maintaining Access: Establishing persistent backdoors for ongoing control.
  • 5. Covering Tracks & Reporting: Preserving forensic logs and documenting fixes.
Mission Scenario: You are a security researcher hired by BankInReach, an online bank, to perform an authorized penetration test. Your job: find weaknesses before real attackers do. Follow the 5 phases of pentesting and see how an attacker thinks.
Question 1 of 3

Before We Begin — What Do You Know?

Answer honestly. No right or wrong feedback now. We'll revisit these at the end.
Question text goes here...
Phase 1
Reconnaissance: Collect target intelligence before touching systems. Passive recon leaves no trace; active recon interacts directly and risks detection.
⚪ Passive Recon (0/2 saved) ⚪ Active Subdomains
🔒 https://infoscout.local
InfoScout v1.0

Search public registries, job boards, and OSINT databases without touching target servers.

Phase 2
Scanning: Probe target system to discover open ports, running services, and specific software versions.
⚪ Standard Port Scan ⚪ Vulnerability Scan
operator@weakspot:~$ nmap -sV admin.bankinreach.com
Phase 3
Gaining Access: Weaponize the discovered CVE-2021-41773 vulnerability to penetrate admin.bankinreach.com.
⚪ Exploit Script ⚪ Admin Session
🔒 https://exploit-db.org/search?q=Apache+2.4.49
ExploitDB Browser
Phase 4
Persistence: Plant a backdoor user account via profile script upload to maintain control across reboots.
⚪ Backdoor Script Upload ⚪ GodInReach Admin Backdoor
🏦 BankInReach Admin Portal — Welcome, rajan.iyer
📊 Dashboard
👥 Users
💳 Transactions
📋 Logs
⚙️ Settings
Total Users
24,391
Active Sessions
142
Pending KYC
38

Upload Backdoor for Persistent System Access

Click the pulsing '+' icon in the top-right profile avatar to access the file upload vulnerability on this server.

Phase 5
Covering Tracks & Reporting: Attackers delete logs to hide tracks; ethical pentesters preserve forensic evidence and document fixes.
⚪ Classify 6 Logs ⚪ Report Fix
📋 System Logs — admin.bankinreach.com 0/6 Classified

Classify each log entry. What would a malicious attacker do vs. an ethical pentester?
Rule: Ethical pentesters keep logs for auditing!

📄 Pentest Report — BankInReach CONFIDENTIAL
admin.bankinreach.com
CVE-2021-41773 — Apache 2.4.49 RCE
Port 443 (HTTPS)
Administrator (rajan.iyer)
Script upload → GodInReach backdoor account
0 / 20 characters
Final Assessment — Part 1 of 2

Put the 5 Pentest Phases in the Correct Order

Use the ▲ ▼ arrows to arrange the phases in the correct sequence from first to last.

Your Pentest Journey — Results

Comprehensive Performance & Knowledge Improvement Report

📊 Knowledge Growth: Pre-Assessment vs Post-Assessment
Before: 0/3 | After: 0/3 | Improvement: +0
📈 Phase Quiz Mastery Breakdown Scale: Score / 3
⏱️ Ethical Attack Timeline
Phase 1: Reconnaissance
You found the admin portal: admin.bankinreach.com
Phase 2: Scanning
You discovered Apache 2.4.49 running on port 443 with critical vulnerability CVE-2021-41773
Phase 3: Gaining Access
You exploited CVE-2021-41773 and logged in as administrator rajan.iyer
Phase 4: Persistence
You planted a backdoor account as GodInReach via script upload
Phase 5: Reporting
You preserved all forensic logs and submitted remediation recommendations
🎖️

Pentest Simulation Clearance Certificate

Awarded to the Hacker

For successful completion of the BankInReach Security Audit

18 / 18 Total Points

Certified Ethical Penetration Tester — Trainee Level