Interactive Checklists & Audit Runner
How to design, execute, and link security tools, scripts, and payloads to interactive penetration testing checklists.
The blackLen Checklist Engine replaces static spreadsheets with dynamic, state-aware execution pipelines designed specifically for offensive security assessments and compliance audits.
7-State Verification Lifecycle
Each checklist step supports 7 discrete status states to accurately reflect testing progress:
| Status | Code | Meaning & Use Case |
|---|---|---|
| Pending | pending | Initial state; awaiting tester pickup or initial scoping. |
| In Progress | in-progress | Actively undergoing manual testing or tool execution. |
| Pass | pass | Target successfully validated with no vulnerability observed. |
| Fail | fail | Vulnerability identified; evidence and reproduction notes documented. |
| N/A | na | Test case not applicable to the target technology stack. |
| Blocked | blocked | Test blocked by WAF rate limits, missing test credentials, or target downtime. |
| Skipped | skipped | Explicitly excluded from engagement scope or Rules of Engagement. |
Evidence & Execution Notes
For every checklist item, operators can record findings directly in dedicated execution fields:
- Evidence Field: A structured text field for documenting reproduction URLs, proof-of-concept outputs, issue tracker links, or external report references.
- Execution Notes: A collaborative notes field for logging testing observations, parameter values, or tester hand-off context.
Evidence is stored as structured text and links. For large binary captures or external artifacts, link your preferred secure repository into the evidence field.
Linking Tools, Scripts & Payloads
Checklist steps in blackLen connect directly to your offensive toolset:
- Command Templates: Link pre-configured CLI commands (e.g., Nmap scan profiles, FFUF fuzzing syntax) with target placeholder variables.
- Custom Scripts: Link versioned Python, Bash, or PowerShell scripts authored in the Monaco Script IDE.
- Attack Payloads: Attach categorized payload items from your organization vault for immediate access during manual verification.
The "Tick-Mark Only" Auditor Workflow
For compliance reviewers, quality assurance testers, or junior analysts, blackLen provides a dedicated Project Auditor role:
- What Auditors CAN do: Toggle item verification statuses (
Pending,In Progress,Pass,Fail,N/A,Blocked,Skipped), update completion checkboxes, and add execution notes. - What Auditors CANNOT do: Add new checklist items, delete test cases, or modify the engagement's target asset scope.
This ensures audit integrity and prevents accidental template corruption during large team engagements.