❖ Capture the Flag ❖ Scope: *.capstone.e-z-company.org ❖ Anything hosted on 173.82.17.138 is SaaS (i.e., software is out of scope) ❖ Anything hosted on Azure – underlying services implementation out of scope ❖ Servers on 10.8.0.0/24 are IaaS – app applications (including OS) in scope ❖ Rules of Engagement: ❖ Production environment –(i.e., no permanent effects) ❖ No mass brute-forcing ❖ No DoS attacks ❖ If the domain resolves to a private IP address, then use the class VPN ❖ Objective: ❖ Attain the flag file located on docker.capstone.e-z-company.org (hint – need to leverage/exploit other systems/services in the scope) ❖ Administrative Requirement: ❖ completed pentest report (min 3 findings)