**Halden Security** jamoasidasiz. Mijoz — **Marrowdene Freight** (logistika operatori) — o'z mijoz-portalini tekshirishga rozi bo'ldi. Ish endi rasmiy **Engagement Operations Console** orqali yuritiladi: engagement bir holat mashinasi bo'lib, besh bosqichdan **qat'iy tartibda** o'tadi — `pre-engagement → kick-off → active-testing → reporting → closure`. Har bosqichni yakunlash (sign-off) uchun o'sha bosqichning **yetkaziladigan natijasi** (deliverable) bo'lishi shart. Eng muhimi — oxirgi bosqich: engagement davomida konsol test artefaktlarini yaratadi (**svc-pentest** akkaunti, faol sessiyalar, yig'ilgan ma'lumot keshi). Ularni tozalamasdan **Closure yakunlanmaydi** — qoldirilgan artefakt real hujumchi uchun tayyor kirish vektoriga aylanadi. ## 🎯 Maqsad Engagementni to'g'ri tartibda, har bosqichning natijasi bilan yuriting va oxirida barcha test izlarini tozalab, **Engagement Closure Record** (flag)ni oling. ## 🚀 Ishga tushirish 1. Pastdagi **Deploy** tugmasini bosing — ~20 soniyada shaxsiy nusxangiz tayyor bo'ladi. 2. Sizga `https://.lab.hacknow.uz` havolasi beriladi. Bu **web lab** — **VPN/tun0 kerak emas**, brauzer yoki `curl` yetadi. Brauzerda "Operations Console" boardida bosqich pipeline'i, joriy bosqich amali va tozalash ro'yxati ko'rinadi. ## 🔍 Razvedka va bosqichlar ```bash U=https://.lab.hacknow.uz # 0) engagement holati + ops_key (holat o'zgartirishda kerak) curl -s "$U/api/engagement" # 1) pre-engagement -> kick-off (hujjatlar imzolangan) curl -s -X POST "$U/advance" -d "ops_key=&phase=pre-engagement&docs=signed&raw=1" # 2) kick-off -> active-testing (aloqa + favqulodda kontakt) curl -s -X POST "$U/advance" -d "ops_key=&phase=kick-off&comms=Signal&emergency_contact=SOC&raw=1" # 3) kritik topilmani top va DARHOL xabar ber curl -s "$U/testing/scan" curl -s -X POST "$U/testing/report" -d "ops_key=&finding_id=&raw=1" curl -s -X POST "$U/advance" -d "ops_key=&phase=active-testing&raw=1" # 4) reporting -> closure (risk darajasi) curl -s -X POST "$U/advance" -d "ops_key=&phase=reporting&severity=critical&raw=1" # 5) closure: uchala test artefaktini o'chir, so'ng yakunla -> flag curl -s "$U/closure/checklist" for a in account sessions data; do curl -s -X POST "$U/closure/cleanup" -d "ops_key=&artifact=$a&raw=1"; done curl -s -X POST "$U/advance" -d "ops_key=&phase=closure&raw=1" ``` Tuzoqlar (dars — flag bermaydi): noto'g'ri tartibdagi bosqich → `409`; hujjatsiz pre-engagement → `412`; aloqasiz kick-off → `428`; topilma xabar qilinmay active-testing → `425`; artefakt tozalanmay closure → `422`; ops_key noto'g'ri → `401`. > **Eslatma:** flag faqat **sizning konteyneringizda** amal qiladi. `engagement_id`, `ops_key` va `finding_id` har nusxada tasodifiy — ularni o'z labingizdan oling.

Marrowdene engagement: kick-off'dan closure'gacha yakunla