Reflections on My First Penetration Testing Engagement

Recently, I completed my first professional penetration testing engagement on a small startup's website. The scope was limited to a marketing landing page with a contact form with not much functionality to explore. But it does ended up teaching me few things and here's how it actually went.

Reconnaissance:

It began with standard reconnaissance, like reviewing robots.txt, checking for a sitemap and examining page source for exposed information such as developer comments or leftover metadata.

An early observation shaped the rest of the engagement: site was built on a no-code platform. This meant the assessment was less about identifying custom application logic flaws and more about auditing configuration, like evaluating what the platform exposes, what it restricts by default and where gaps exist within client's control.

Checklist I followed:

Over the course of engagement, these are the checklists I followed.

• Information disclosure (page source, robots.txt, sitemap)
• Input validation and injection testing on contact form
• HTTP response header configuration
• Cookie attribute review (session handling)
• SSL/TLS configuration
• CORS configuration on API calls
• HTTP method restrictions (verifying only expected methods are permitted)
• Mixed content and resource loading over HTTPS
• Sub-resource Integrity (SRI) on third party assets
• Subdomain enumeration and verification of live services

Each one was tested methodically, documented and rated by severity, regardless of whether it produced a finding.

Lessons learnt:

• Document everything even if its not a bug
• Defense-in-depth matters even without a direct exploit path
• Practical tool usage reinforces theoretical knowledge in a way labs don't
• Limited scope is not a limited learning opportunity

Summary:

This engagement reflects a common reality in professional penetration testing, particularly for smaller organizations: the work is often defined less by discovery of severe vulnerabilities and more by rigor and completeness of assessment process itself.

Delivering a clear, well documented account of what was tested, including negative results, in many cases is the primary value delivered to the client. For those early in their security testing careers, a straightforward scope should not be viewed as a limited opportunity. It is, in many aspects, where foundational testing discipline is most effectively developed.