Pentest Engagement Handbook

This handbook is about the methodology and tooling of a pentest engagement, not the Arsenic CLI. Every step here is something you can run by hand with off-the-shelf tools. Arsenic just glues these steps together and keeps the output organized; this is my attempt to write down what it’s gluing together and why.

If you only want to drive Arsenic, the Arsenic docs cover that.

Who this is for

This started as the runbook I built for myself while studying for the OSCP. I kept hardening it into a repeatable process while running a pentest team, and this is where it landed. It assumes you can use a shell, read tool output, and that you have written authorization for every target you point these tools at.

How an engagement flows

A network/web engagement moves through five phases, and each one feeds the next. You turn a handful of in-scope roots into a full asset inventory, then a service map, then a list of likely weaknesses, then confirmed findings.

The phases are a loop, not a line. Discovery surfaces new domains, which expand scope, which feeds discovery again. Recon turns up a forgotten admin panel that becomes a new lead. I’ve found it’s easiest to settle into the loop and keep re-running the cheap steps as scope grows.

The toolchain at a glance

Here’s the full set of tools the handbook uses, grouped by phase. Where a tool Arsenic originally shipped has since aged out, I’ve noted what I reach for now. The Toolbox Reference has the install commands and the full mapping.

• Discovery: amass, subfinder, crt.sh, dnsx (replaces fast-resolv), nmap -sn, naabu
• Recon: nmap, naabu, httpx, gowitness (replaces aquatone), ffuf, feroxbuster
• Hunting: nuclei, searchsploit, nuclei/subzy for takeovers
• Glue: jq, mlr (miller), anew, SecLists wordlists

Using these docs in Docsy

This folder is a self-contained Docsy content section. Drop it into your site under content/en/ (or wherever your docs live) and it renders as a top-level section. Page ordering comes from the weight front matter on each file, so you reorder by editing weights rather than renaming files.

One reminder before you start: everything here is for authorized testing only. Active scans — port scans, brute force, fuzzing, nuclei — generate traffic that’s trivially attributable to you and can knock fragile services over. Get scope, rate limits, and blackout windows in writing before you run any of it against a live target.