Pentesting Conventions

Background reference for pentesting workflows. Covers target notation, output formats, safety architecture, scope configuration, lab targets, and project structure.

Target Notation

• IP addresses -- Single host (10.0.0.1) or CIDR range (192.168.1.0/24)
• Hostnames -- Fully qualified (example.com) or short names
• URLs -- Full URL format (http://localhost:8080/path)
• Localhost equivalents -- localhost and 127.0.0.1 are interchangeable
• Lab targets -- Always use localhost paired to the correct port (see Lab Targets below)

Output Expectations

If wrapper scripts are available (in-repo mode):

Use-case scripts (scripts/<tool>/<use-case>.sh) support two flags: