Security Research & Penetration Testing with Cal Security & Forensics LLC
A practical guide for security professionals, consultants, and their clients on using Cal Security & Forensics LLC tools responsibly within authorized engagements.
Authorization is not optional
Every tool in Cal Security & Forensics LLC is designed for use against systems you own or have explicit written permission to test. Unauthorized access to computer systems is a criminal offense in virtually every jurisdiction — including the Computer Fraud and Abuse Act (CFAA) in the US, the Computer Misuse Act in the UK, and equivalent laws worldwide. Written authorization does not just protect your client — it protects you.
Five rules for every engagement
A signed Rules of Engagement (ROE) document or Statement of Work (SOW) must exist before any tool is used against a target. Verbal permission is not sufficient. The document must name the specific systems, IP ranges, and domains in scope.
Anything not listed in the scope document is out of bounds. This includes third-party services, cloud providers, and CDNs that the target uses. Accidentally testing an out-of-scope system is still unauthorized access.
Use Cal Security & Forensics LLC's Session History export (Ctrl+Shift+H) to generate a timestamped log of tool activity. Export as JSON or CSV and attach it to your engagement report. This creates an audit trail that protects both you and your client.
Before any active testing, agree on a kill switch procedure with your client. This means a direct phone number for someone who can halt testing, pull a system offline, or escalate internally if something unexpected happens.
Remove any test accounts, shells, payloads, or artifacts you created during the engagement. Document what was created and confirm removal in your final report.
How Cal Security & Forensics LLC tools work — what they do and don't do
Every Cal Security & Forensics LLC tool is client-side only. Payloads, wordlists, and analysis results are generated in your browser and never transmitted to any server. This means tools cannot accidentally fire against a live target — every action requires a deliberate copy-paste or manual step. The only tools that make live network requests are DNS Lookup (via Cloudflare DoH) and the Threat Intel Lookup proxy. All other tools operate entirely offline once the page is loaded.
Engagement workflow — phase by phase
Begin every engagement with passive reconnaissance before touching any live infrastructure. This phase produces no network traffic to the target.
Generate passive search queries to discover exposed files, login panels, directory listings, and misconfigured services indexed by search engines. No packets are sent to the target.
Map the organization's registered domains, IP ranges, registrar details, and administrative contacts. Cross-reference with the scope document to confirm you have the right targets.
Identify accounts associated with target personnel across platforms. Useful for social engineering risk assessment and credential exposure checks.
Verify the format of credential data found in breach datasets to assess exposure risk. Never use actual credentials against live systems without explicit authorization.
Real-traffic DoS/DDoS resilience testing
Cal Security & Forensics LLC's DoS/DDoS Simulator is educational and generates no real traffic — it is safe to run at any time and is ideal for planning, client education, and documenting attack mechanics. For commercial engagements that require actual resilience validation (load testing, stress testing, volumetric attack simulation), you need purpose-built external tooling. This section covers the full workflow.
Real-traffic load and stress testing must only be performed against infrastructure the client owns, during agreed time windows, with upstream ISP notification. Generating attack traffic against systems without explicit written authorization is a criminal offense regardless of intent.
Best for testing web application servers, APIs, and CDN edge capacity. Simulates realistic browser-like request patterns.
Scripted load tests in JavaScript. Ramp-up profiles, thresholds, and CI/CD integration. Outputs p95/p99 latency, error rates, and throughput.
Python-based, distributed load generation. Web UI for real-time monitoring. Good for complex user journey simulation.
Lightweight, high-throughput HTTP benchmarking. wrk2 adds constant-rate load generation for accurate latency percentiles.
GUI-based test plan builder. Supports HTTP, HTTPS, WebSocket, JDBC. Widely accepted in enterprise and compliance contexts.
Tests firewall throughput, SYN flood resilience, UDP flood handling, and network device capacity. Requires root/admin privileges and ISP notification.
Craft custom TCP/UDP/ICMP packets. SYN flood simulation, traceroute, firewall testing. Precise control over flags, TTL, and payload.
Measures raw TCP/UDP bandwidth between two endpoints. Requires a server instance on the target side — ideal for testing internal network segments.
Volumetric flood tools. Only appropriate in fully isolated lab environments or against dedicated test infrastructure. Never use against production systems or shared hosting.
Managed services that provide distributed load generation from global PoPs, compliance-friendly reporting, and built-in safeguards. Preferred for enterprise engagements.
Managed k6 execution with distributed load from multiple regions. Built-in dashboards, test comparison, and team collaboration.
JMeter-compatible cloud platform. Geo-distributed load, real-time reporting, and compliance-ready PDF reports. Common in enterprise pentest deliverables.
Serverless load generation using AWS Fargate. Scales to thousands of concurrent users. Integrates with CloudWatch for target-side metrics.
Full engagement workflow
Agree with the client on what is being measured: maximum concurrent users before degradation, time-to-failure under sustained load, recovery time after traffic spike, or firewall/IPS throughput limits. Each objective maps to a different tool and test profile.
Run the DoS/DDoS Simulator in Cal Security & Forensics LLC to model the attack type, calculate theoretical impact, and generate the mitigation strategy section of your report. Export the session log (Ctrl+Shift+H) as a planning artifact. This step requires no authorization and can be done before the engagement window opens.
Before any load is applied, capture baseline metrics: average response time, p95/p99 latency, error rate, CPU/memory utilization on the target. Use k6 or wrk at minimal load (5–10 virtual users) to establish the baseline. Document these numbers — they are the reference point for all findings.
Start at 10% of the agreed maximum load and increase in 10% increments, pausing 2–3 minutes at each level to observe stabilization. Record the inflection point where error rate exceeds 1% or p95 latency doubles — this is the practical capacity limit. Never jump directly to maximum load.
Confirm that the client's WAF, rate limiter, or DDoS mitigation service triggered at the expected threshold. Document the detection latency (time from attack start to alert) and mitigation latency (time from alert to traffic scrubbing). These are key deliverables for the report.
Include: baseline metrics, capacity limit with supporting graphs, detection and mitigation latency, any misconfigurations found (e.g., rate limits not applied to all endpoints, WAF bypass via direct-to-origin IP), and remediation recommendations. Attach the Cal Security & Forensics LLC session export and tool output logs as appendices.
Cal Security & Forensics LLC + external tools: Cal Security & Forensics LLC and external load testing tools are complementary, not competing. Use Cal Security & Forensics LLC for planning, attack-type education, mitigation strategy documentation, and session audit trails. Use k6, Locust, hping3, or a managed platform for the actual traffic generation. The combination gives you a complete, defensible engagement deliverable.
DoS/DDoS testing checklist
Pre-engagement authorization checklist
Legal framework reference
Federal law criminalizing unauthorized access to computer systems. Written authorization is the primary defense. Scope creep — testing systems not listed in the authorization — can constitute a violation even during an otherwise authorized engagement.
Criminalizes unauthorized access, unauthorized access with intent, and unauthorized modification of computer material. Penetration testers must have explicit written consent from the system owner.
If testing exposes personal data (user records, credentials, PII), handling that data during a pentest engagement may trigger GDPR obligations. Agree on data handling procedures with the client before testing begins.
The Penetration Testing Execution Standard (PTES) and OWASP Testing Guide provide methodology frameworks that align with legal and professional standards. Following a recognized methodology strengthens the defensibility of your engagement.
Cal Security & Forensics LLC logs every tool action locally in your browser. Open the session drawer with Ctrl+Shift+H and export a timestamped JSON or CSV log to attach to your pentest report.