Your First Pentest: Recon to Report

Scan a vulnerable VM, find CVEs, and write a professional pentest report.

Introduction

30 Second Summary

Every company with an internet connection worries about hackers finding a way in. The people they hire to find those weaknesses first are called penetration testers.

In this project, you will set up a safe, isolated lab and conduct a full penetration test against a deliberately vulnerable server. You will move through reconnaissance, scanning, and vulnerability research, then compile your findings into a professional report.

What You'll Build

Picture showing a hiring manager a report where every finding links back to a real vulnerability you personally discovered and documented on a live server.

By the end of this project, you'll have:

A working penetration testing lab where your Kali Linux VM attacks a vulnerable target on an isolated network, and you can discover every running service.
Scan results from Nmap showing exact software versions on each open port, matched to known vulnerabilities with CVE numbers.
A professional pentest report that ranks each vulnerability by severity, includes scan evidence, and recommends fixes a non-technical manager can act on.
Secret Mission: Use Metasploit to exploit a discovered vulnerability and gain a root shell on the target system.

Are there any prerequisites?

This project assumes you already have VirtualBox installed with a Kali Linux VM ready to go. You will download and set up the vulnerable target (Metasploitable 2) as part of Step 1.

Before We Start

Before any hands-on hacking begins, let's commit to what you're about to build and why it matters. Understanding the full arc of this penetration test will keep every command you run purposeful.

Set Up the Target and Isolated Network

Every penetration test needs a target. Running scans against random systems on the internet is illegal. You need a controlled, isolated environment where you can attack freely without risk.

In this step, you will download Metasploitable 2, a deliberately vulnerable Linux server built for exactly this purpose. You will also create an isolated network inside VirtualBox so your Kali Linux VM can communicate with the target without touching any real network.

In this step, get ready to:

Download and import Metasploitable 2 into VirtualBox.
Configure an isolated Host-Only network for both VMs.
Boot both VMs and verify they can communicate.

Download and import Metasploitable 2 into VirtualBox

Metasploitable 2 is a free VM packed with intentionally vulnerable services. It is your legal, safe target for this entire project.

On your Windows host, open your web browser and navigate to the Metasploitable 2 download page on SourceForge.
Download metasploitable-linux-2.0.0.zip (865 MB). This may take a few minutes depending on your connection.

Why such a large file?

The ZIP contains a full virtual hard disk (VMDK format) with a complete Linux installation pre-loaded with vulnerable services. You are downloading an entire operating system image.

Once the download completes, right-click the ZIP file in File Explorer and select Extract All.
Choose a location you can easily find (such as your Desktop) and click Extract.

After extraction, open the folder. You should see several files including one ending in .vmdk. This is the virtual hard disk that VirtualBox will use.

In VirtualBox Manager, click Machine in the top menu bar.
Click New to open the Create Virtual Machine wizard.
On the Name and Operating System page, enter Metasploitable2 as the Name.
Set Type to Linux and Version to Other Linux (64-bit).
Do not select an ISO image. If you see a Skip Unattended Installation checkbox, check it.
Click Next to proceed to the Hardware page.
Set the Base Memory slider to 512 MB.
Click Next to proceed to the Hard Disk page.
Select Use an Existing Virtual Hard Disk File.
Click the folder icon to browse, then navigate to the extracted folder and select the .vmdk file.
Click Finish to complete the wizard.

Your new Metasploitable2 VM now appears in the VirtualBox Manager list on the left side.

Don't see the VMDK file when browsing?

Make sure you extracted the ZIP file fully. The VMDK is inside the extracted folder, not in the ZIP itself. Also check that the file browser is showing all file types, not filtering by extension.

Help me find the Metasploitable 2 VMDK file in my extracted folder.

Configure an isolated Host-Only network for both VMs

A Host-Only network creates a private network that exists only between your VMs and your host machine. No traffic can reach the internet or your home network. This is what keeps your pentest legal and safe.

In VirtualBox Manager, click File in the top menu bar.
Click Tools, then select Network Manager.
Select the Host-only Networks tab.
Click Create to add a new Host-Only adapter.

A new adapter appears in the list (named something like VirtualBox Host-Only Ethernet Adapter). Note this name for the next steps.

With the new adapter selected, confirm that the DHCP Server checkbox is enabled. DHCP automatically assigns IP addresses to VMs on this network (in the 192.168.56.x range).
Close the Network Manager window.

Why not just use the default NAT adapter?

VirtualBox defaults to NAT, which gives VMs internet access through your host. That is dangerous for a pentest lab. Your scanning tools could accidentally probe real servers on your network.

Host-Only creates a sealed bubble. Your Kali VM can reach Metasploitable 2, but neither can touch the outside world.

Now you need to attach both VMs to this Host-Only adapter.

In VirtualBox Manager, right-click your Metasploitable2 VM and select Settings.
Click the Network tab on the left.
Under Adapter 1, change Attached to from its current setting to Host-Only Adapter.
In the Name dropdown, select the adapter you just created (e.g., VirtualBox Host-Only Ethernet Adapter).
Click OK to save.

Repeat the same network configuration for your Kali Linux VM.

Right-click your Kali Linux VM and select Settings.
Click the Network tab.
Under Adapter 1, change Attached to to Host-Only Adapter.
Select the same adapter name from the dropdown.
Click OK to save.

Both VMs are now on the same isolated network. They can talk to each other but cannot reach the internet.

Boot both VMs and verify connectivity

The network is configured. Now you will boot both VMs and confirm they can communicate before moving on to actual scanning.

In VirtualBox Manager, select Metasploitable2 and click Start.
Wait for the login prompt to appear. Log in with username msfadmin and password msfadmin.

What are these credentials?

Metasploitable 2 ships with known default credentials (msfadmin/msfadmin) because it is designed to be attacked. In the real world, default credentials are one of the most common security failures.

Once logged in, find the Metasploitable 2 IP address by running this command:

ifconfig

Look for the inet addr value under the eth0 interface. It will be in the 192.168.56.x range (for example, 192.168.56.101). Write this IP down.

Now select your Kali Linux VM in VirtualBox Manager and click Start.
Once Kali boots to the desktop, open a terminal by right-clicking the desktop and selecting Open Terminal Here, or by clicking the terminal icon in the taskbar.
Confirm your Kali VM has an IP on the same subnet by running:

ip a

You should see an IP address in the 192.168.56.x range listed under your eth0 interface. Both VMs are now on the same network.

Before you run the connectivity test, what do you think will happen when you ping the Metasploitable 2 IP from Kali? Will the packets arrive or time out?

Test connectivity from Kali to your target by running this command (replace the IP with the one you noted from Metasploitable 2):

ping -c 4 [[METASPLOITABLE_IP="your Metasploitable2 IP address"]]

You should see four successful replies with round-trip times displayed. This confirms both VMs can communicate on the isolated network.

Seeing 'Destination Host Unreachable' or 100% packet loss?

Check these common causes:

Both VMs must be set to the same Host-Only adapter. Go to each VM's Settings > Network and confirm they both show the same adapter name.
Make sure DHCP is enabled in the Network Manager for your Host-Only adapter. Without DHCP, the VMs will not receive IP addresses automatically.
If you changed the network settings while a VM was running, you need to reboot that VM for the changes to take effect.

Help me troubleshoot why my Kali VM cannot ping my Metasploitable 2 VM on the Host-Only network.

Your lab is ready. You have a Kali Linux attacker and a Metasploitable 2 target sealed off from the outside world. Next up, you will point Nmap at this target and discover every service it exposes.

Discover the Target with Nmap

Your lab is live. Both VMs can communicate on the isolated network, and you have confirmed connectivity with a successful ping.

A pentester's first real move is discovering what services are running on the target. Without this intelligence, you are attacking blind. This step produces the raw data that everything else in this project builds on.

In this step, get ready to:

Run a basic port scan to discover what services the target exposes.
Run an aggressive scan to identify exact software versions and OS details.
Save and analyze the scan results to identify targets for vulnerability research.

Run a basic port scan to discover open services

The first phase of any pentest is reconnaissance. You need to know what doors are open before you can try to walk through them.

Before you run your first scan, what do you expect to see? How many services do you think a deliberately vulnerable server might expose?

Run a basic Nmap scan against your Metasploitable 2 target:

nmap [[TARGET_IP="your Metasploitable2 IP address"]]

Your terminal displays a table of open ports with service names like ftp, ssh, and http. Metasploitable 2 intentionally exposes over 20 vulnerable services, so the list is long.

What does this output mean?

Each line in the results represents a network port that is accepting connections. The STATE column shows open, meaning the service behind that port is actively listening for traffic.

The SERVICE column shows Nmap's best guess at what software is running. This basic scan only reports the default service name for each port number. It does not yet reveal exact software versions.

Not seeing any results?

Make sure you typed the correct IP address for your Metasploitable 2 VM. Run ifconfig inside the Metasploitable 2 terminal to double-check its IP.

If you see "Host seems down", confirm both VMs are set to the same Host-Only adapter in their network settings.

help me troubleshoot why my Nmap scan is not returning results against my Metasploitable 2 target on a VirtualBox Host-Only network

Run an aggressive scan for deep service intelligence

The basic scan told you which ports are open. Now you need the details that make those ports exploitable: exact software versions, the operating system, and any vulnerabilities that Nmap's scripts can detect automatically.

Run an aggressive scan and save the results to a file in one command:

nmap -A -T4 [[TARGET_IP="your Metasploitable2 IP address"]] -oN scan_results.txt

What do these flags do?

-A enables OS detection, version detection, script scanning, and traceroute all at once. It is the recommended shorthand for an aggressive scan.
-T4 sets aggressive timing so the scan finishes faster. This is safe on a local lab network.
-oN scan_results.txt saves the output in normal (human-readable) format to a file, while still displaying it in your terminal.

This scan takes longer than the basic one. Wait for it to finish completely. You will see much richer output this time, including exact software versions like vsftpd 2.3.4 and OS detection results.

Confirm the results file was created by running:

ls ~/scan_results.txt

You should see scan_results.txt listed in the output.

Scan taking too long?

An aggressive scan on Metasploitable 2 typically takes 1-3 minutes. If it hangs for much longer, press Ctrl+C to cancel and try again. Make sure no other intensive processes are running on your host machine.

help me understand why my Nmap aggressive scan is taking too long against Metasploitable 2 on a Host-Only network

Analyze what the scan reveals

You now have a detailed intelligence file on your target. The next step is reading it like a pentester: looking for specific version numbers that you can cross-reference against known vulnerabilities.

View your saved scan results:

cat ~/scan_results.txt

Scroll through the output and look for three things.

Services with specific version numbers. These are your primary targets. A version number like vsftpd 2.3.4 or Samba 3.x can be searched against vulnerability databases.
OS detection results. Nmap fingerprints the target's operating system. Knowing the OS helps narrow down which exploits will work.
NSE script findings. Nmap's NSE (Nmap Scripting Engine) runs automated checks and may flag services as potentially vulnerable or misconfigured.

Why do version numbers matter so much?

Every piece of software has a history of discovered bugs. When you know the exact version running on a target, you can search databases like Exploit-DB for known vulnerabilities that affect that specific release.

This is why Nmap's version detection is so powerful. It turns a generic "FTP server" into a specific "vsftpd 2.3.4" that you can research and potentially exploit.

Keep your terminal open

You will reference these scan results in the next step when you research specific vulnerabilities. Keep scan_results.txt accessible.

You have completed your first real reconnaissance engagement. Your Nmap scans revealed over 20 open services with exact version numbers, OS details, and script findings on the Metasploitable 2 target. All of this intelligence is saved in scan_results.txt for the next phase.

Next up, you will take those version numbers and cross-reference them against vulnerability databases to find real, exploitable security flaws.

Research Vulnerabilities from Your Findings

Your Nmap scan revealed a wealth of raw data about the Metasploitable 2 target. You know which ports are open, which services are running, and which software versions are installed.

Raw scan data is meaningless without context. A professional pentester cross-references discovered versions against known vulnerability databases. This is where you connect a version number like "vsftpd 2.3.4" to a specific exploit with a CVE number and a severity rating.

In this step, get ready to:

Research at least 3 services from your scan results for known vulnerabilities.
Categorize each finding by severity level (Critical, High, Medium/Low).

Pick 3 services from your scan results and research them

Your saved scan results contain version numbers for every service on the target. Each version number is a clue that may lead to a known vulnerability.

In your Kali terminal, review the scan results by running this command:

cat ~/scan_results.txt

Look for entries with specific version numbers. You should see services like vsftpd 2.3.4, Samba 3.x, and Apache 2.2.x among the 20+ open ports.

What am I looking for?

Focus on lines that show a service name followed by a version number. The more specific the version, the easier it is to find matching vulnerabilities. Generic entries like "tcpwrapped" are not useful for this research.

Now you will use searchsploit to look up known exploits for the first service. Before you run it, what do you expect to find for an FTP server running a version from 2011?

Search for exploits targeting vsftpd 2.3.4 by running:

searchsploit vsftpd 2.3.4

You should see a table with at least one result referencing a backdoor command execution exploit. This is CVE-2011-2523, a backdoor that opens a shell on port 6200/tcp when triggered.

What does this output mean?

The searchsploit command searches a local copy of the Exploit Database for known exploits matching your search terms. The output table shows the exploit title and the path to the exploit file on your system.

This is the same workflow a professional pentester follows. You find a version number in your scan, look it up in a vulnerability database, and now you know exactly what attack is possible.

No results from searchsploit?

Make sure you typed the version number exactly as shown in your scan results. The search is case-insensitive, but spelling matters.

If you get zero results, try broadening the search by removing the minor version number (e.g., just searchsploit vsftpd).

help me troubleshoot searchsploit returning no results for vsftpd 2.3.4

Now search for a second service. Samba is another service exposed on Metasploitable 2 with known vulnerabilities.

Search for Samba exploits by running:

searchsploit samba 3

You should see multiple results. Look for entries referencing "username map script" or "Command Execution" as these are relevant to the Samba version on your target.

Search for a third service. Try one more from your scan results by running:

searchsploit apache 2.2

You should see results for Apache vulnerabilities. Some may be denial of service, others may allow information disclosure or remote code execution.

Use the -w flag for more detail

If you want to read more about a specific exploit, add the -w flag to show URLs to Exploit-DB.com instead of local paths. For example: searchsploit -w vsftpd 2.3.4.

Categorize findings by severity

You now have exploit results for at least 3 services. The next step is sorting them by how dangerous they are. This mirrors how professional pentesters use CVSS scoring to prioritize findings for their clients.

Record the following information for each vulnerability you found. You can use a text editor, a notepad, or simply keep notes in your head for now.

For each service, note the CVE number, what the vulnerability does, and assign a severity:
Critical: Vulnerabilities that give remote root access. Example: vsftpd 2.3.4 backdoor (CVE-2011-2523) opens a root shell on port 6200/tcp.
High: Vulnerabilities that allow unauthorized access or data exposure. Example: Samba "username map script" command execution.
Medium/Low: Information disclosure or weak configurations. Example: Apache version disclosure or directory listing.

Why categorize by severity?

Clients and employers do not want a flat list of everything that is wrong. They need to know what to fix first. A backdoor giving instant root access is far more urgent than an information disclosure issue.

This severity ranking is what separates a useful pentest report from a raw tool dump. You will use these categories directly in your report in the next step.

Before moving on, confirm you have at least 3 vulnerabilities documented. Each one should have a CVE number (or exploit reference), a description of what it does, and a severity category.

Verify your research by running one more lookup to confirm a CVE number:

searchsploit --cve 2011-2523

You should see the vsftpd backdoor exploit listed, confirming the CVE number matches the vulnerability you identified.

Not sure which CVEs to record?

Start with the guaranteed one: vsftpd 2.3.4 maps to CVE-2011-2523 (Critical). For your other two findings, note the exploit title from searchsploit output. If the output does not list a CVE directly, search the exploit title in your browser to find the associated CVE number.

help me identify CVE numbers for Samba and Apache vulnerabilities found on Metasploitable 2

You now have documented vulnerability research ready to go into a professional report. Next up, you will turn these findings into a structured pentest report that a hiring manager or client can read and act on.

Write Your Pentest Report

You now have detailed scan results and a list of vulnerabilities with CVE numbers. That raw data is useless if you cannot communicate it clearly.

Hiring managers and clients judge pentesters by the quality of their reports, not the commands they ran. In this step, you will write a professional pentest findings report that turns your technical work into something a non-technical stakeholder can act on.

In this step, get ready to:

Create the report structure with an executive summary.
Document each finding with severity, evidence, and remediation.
Add a methodology section explaining your approach.

Create the report structure

Every professional pentest report follows a standard structure. Readers scan for the executive summary first, then drill into findings. Starting with the right skeleton ensures nothing gets missed.

Open a new file in nano by running this command in your Kali terminal:

nano ~/pentest_report.md

Nano opens with a blank file. Type the following content to set up your report header, executive summary, and scope:

# Penetration Test Report

## Executive Summary

A penetration test was conducted against a single Linux host on an isolated network. The assessment identified multiple critical vulnerabilities, including flaws that allow remote root access with no authentication. The overall risk level is Critical, and immediate remediation is strongly recommended.

## Scope

- **Target:** [[TARGET_IP="your Metasploitable 2 IP address"]] (single Linux host)
- **Network:** Isolated VirtualBox Host-Only network (192.168.56.x)
- **Testing window:** [[TEST_DATE="today's date"]]
- **Tools used:** Nmap, searchsploit
- **Methodology:** Black-box network penetration test

What does each section do?

The Executive Summary gives a non-technical manager the bottom line in 2-3 sentences: what you tested, how bad it is, and what to do next.

The Scope section defines the boundaries of your test. It protects you legally and sets expectations for what was and was not tested.

Save the file by pressing Ctrl+O, then Enter to confirm the filename.
Exit nano by pressing Ctrl+X.
Verify the file was created by running:

cat ~/pentest_report.md

You should see your report header, executive summary, and scope section printed in the terminal.

File is empty or missing?

If cat shows nothing or an error, you likely exited nano without saving. Re-open the file with nano ~/pentest_report.md and make sure to press Ctrl+O then Enter before exiting.

Help me save a file in nano

Document each finding professionally

Each finding in your report needs enough detail for someone else to understand the vulnerability, verify it exists, and fix it. You will document the vsftpd backdoor as your first finding, then add two more from your research.

Re-open your report file by running:

nano ~/pentest_report.md

Move your cursor to the bottom of the file using the arrow keys.
Add the following Findings section header and your first finding below the Scope section:

## Findings

### Finding 1: FTP Backdoor - Remote Root Access

- **Severity:** Critical
- **Affected Service:** vsftpd 2.3.4 (Port 21/tcp)
- **CVE:** CVE-2011-2523
- **Description:** The installed version of vsftpd contains a malicious backdoor that opens a shell on port 6200 when triggered by a specific username pattern. This grants unauthenticated remote root access.
- **Evidence:** Nmap version scan identified vsftpd 2.3.4 running on port 21.
- **Remediation:** Upgrade vsftpd to the latest stable version or replace with a maintained FTP server.

Why this format matters

Each finding follows the same six-field structure: title, severity, affected service, CVE, description, evidence, and remediation. This consistency makes your report scannable. A reader can jump to any finding and immediately understand the risk without reading the whole document.

Now add at least 2 more findings below Finding 1, following the same format. Use the vulnerabilities from your research in the previous step.
For the Evidence field, open a second terminal tab and run cat ~/scan_results.txt to find the relevant Nmap output line for each service.
Save your file with Ctrl+O then Enter, and exit with Ctrl+X.

Verify your findings are saved by running:

cat ~/pentest_report.md

You should see your Executive Summary, Scope, and at least 3 complete findings, each with all six fields filled in.

Not sure what to write for your other findings?

Look at the version numbers from your scan results. If you found Samba 3.x, Apache 2.2.x, or other outdated services, those are your findings. Use searchsploit to refresh your memory on the CVE numbers and descriptions.

Help me write pentest findings for the services I discovered

Add the methodology section

The methodology section proves you followed a structured process. It separates you from someone who randomly ran tools and got lucky. Employers look for this section to confirm you understand the pentest lifecycle.

Open your report one more time by running:

nano ~/pentest_report.md

Navigate to the bottom of the file and add the Methodology and Recommendations sections:

## Methodology

This penetration test followed a structured four-phase approach:

1. **Network Discovery** - Identified the target host on the isolated network using ping and IP address confirmation.
2. **Port Scanning** - Used Nmap to discover all open TCP ports on the target.
3. **Service Enumeration** - Performed aggressive scanning with Nmap (-A flag) to identify exact software versions, OS details, and run default NSE scripts.
4. **Vulnerability Research** - Cross-referenced discovered service versions against known vulnerability databases using searchsploit.

### Tools Used

- **Nmap** - Network scanner for port discovery, service version detection, and OS fingerprinting.
- **searchsploit** - Offline exploit database search tool for identifying known CVEs matching discovered services.

## Recommendations

1. Immediately patch or replace vsftpd 2.3.4 (Critical risk of remote root compromise).
2. Upgrade all services to their latest stable versions.
3. Disable unnecessary services to reduce the attack surface.
4. Implement network segmentation to limit lateral movement.
5. Schedule regular vulnerability assessments to catch new exposures.

What makes this methodology section valuable?

Notice how each phase naturally feeds into the next. Network Discovery confirms your target exists. Port Scanning reveals what is listening. Service Enumeration gets the version details. Vulnerability Research connects those versions to known exploits.

This demonstrates to employers you understand the structured penetration testing methodology, not just random tool usage.

Save the file with Ctrl+O then Enter, and exit with Ctrl+X.

Before you verify the final report, what sections do you expect to see when you print the file?

View your completed report by running:

cat ~/pentest_report.md

You should see a complete professional report with five sections: Executive Summary, Scope, Findings (with at least 3 entries), Methodology, and Recommendations.

Missing a section?

If any section is missing, re-open the file with nano ~/pentest_report.md and scroll through to find where the content dropped off. Make sure each section starts with a ## header.

Help me fix my pentest report structure

✔️ Awesome, I've got everything!

Great. Double check that each of your 3+ findings has all six fields filled in: title, severity, affected service, CVE, description, evidence, and remediation.

ⓧ I'd like to double check the full code

Your report should contain these sections in order. Scroll through your file and confirm each one is present:

Report header (title, target, date, tester).
Executive Summary (2-3 non-technical sentences).
Scope (target IP, network, testing window, tools, methodology type).
Findings (at least 3 entries, each with title, severity, affected service/port, CVE, description, evidence, remediation).
Methodology (four phases described, tools listed with rationale).
Recommendations (prioritized list of fixes).

You now have a complete, professional pentest report that documents real vulnerabilities you discovered through hands-on reconnaissance. This is a portfolio artifact that proves you can find vulnerabilities AND communicate them. Next up, you will go beyond reporting and actually exploit one of these vulnerabilities to prove it is real.

Secret mission

Exploit a Vulnerability with Metasploit

You have found the vulnerabilities and documented them. Now prove they are real by using Metasploit Framework to exploit the vsftpd 2.3.4 backdoor and gain root access to the target system.

Clean Up Your Resources

Decide whether to keep your resources running, pause them to come back later, or delete them entirely. This project runs entirely locally, so there are no ongoing costs. The only footprint is disk space.

Resources you used:

Metasploitable 2 VM in VirtualBox (local, uses ~2 GB disk space).
VirtualBox Host-Only network adapter (local, no disk cost).
Kali Linux VM network adapter changed to Host-Only (the VM already existed before this project).

Keep everything running

No action needed. Choose this if you plan to keep practicing with your pentest lab or want to try more exploits on Metasploitable 2.

Both VMs stay in VirtualBox and can be started any time.
Your pentest_report.md and scan_results.txt files remain on the Kali VM for your portfolio.
The Host-Only network adapter stays configured and ready for future isolated lab sessions.

Pause - I'll come back to this later

Shut down both VMs to free up memory. Your files and VM configurations are preserved and can be restarted anytime.

In the Metasploitable 2 terminal, type sudo shutdown -h now to power it off gracefully.
In VirtualBox Manager, right-click the Kali VM and select Close, then select Power Off.
Both VMs retain their saved state. Start them again from VirtualBox Manager whenever you are ready to continue.

Delete - I don't want to use this again

Remove all project resources and start fresh. Follow these steps to clean up completely.

Power off both VMs if they are still running.
In VirtualBox Manager, right-click the Metasploitable2 VM and select Remove. In the confirmation dialog, choose to delete the VM's associated files. This removes the VMDK and all VM data from your disk.
For the Kali VM, you do not need to delete it since it existed before this project. Instead, revert its network adapter by right-clicking the Kali VM and selecting Settings. Go to Network and change Adapter 1 back to NAT so it can access the internet again.
Remove the Host-Only network adapter. In VirtualBox Manager, go to File, then Tools, then Network Manager. Click the Host-only Networks tab, select the adapter you created, and click the remove button.

What about your report files?

Your pentest_report.md and scan_results.txt live on the Kali VM. If you want to keep them as portfolio pieces, copy them to your host machine before reverting anything.

You can set up a VirtualBox shared folder or simply copy-paste the text content into a file on your host.

Nice Work!

You just completed a full penetration test from start to finish. You built an isolated lab, discovered vulnerabilities on a real target, and documented your findings in a professional report that proves you can operate offensive tools and communicate results clearly.

Here's what you accomplished:

Conducted network reconnaissance using Nmap to discover 20+ open services with exact version details on a deliberately vulnerable target.
Cross-referenced discovered service versions against vulnerability databases and identified critical security flaws with CVE numbers and severity ratings.
Wrote a professional pentest findings report with an executive summary, methodology section, evidence from your scans, and remediation advice for each vulnerability.
Secret Mission: Exploited a real vulnerability using Metasploit and gained root access to the target system, proving your findings were not theoretical.

Ready to quiz yourself?