# Your first pentest

> From signup to the report: create the account, register the application, prove the domain, write the Guidance, launch the pentest, read the results and prepare the retests.

This tutorial follows a complete external pentest of an application `https://app.exemple.fr`. Allow about fifteen minutes of preparation; the duration of the test then depends on the application and on the execution queue.

## Before you begin

- You control the application's domain (access to the web server or to the DNS zone).
- You are authorised to have this application tested: you own it or you hold a prior written authorisation from its owner, valid for the whole duration of the test.
- The application is reachable from the Internet over HTTP(S) on an IPv4 address.

## 1. Create the account

1. Open the signup page and confirm your e-mail address.
2. At first sign-in, SpectrAI proposes a second factor once: authenticator app, e-mail code, or later. It is never imposed on a client; you can enable it from [My account](https://docs.spectr-ai.eu/en/compte-et-securite/connexion-et-second-facteur).
3. A direct signup creates a client space attached to the SpectrAI house agency. It is approved automatically if catalogue sales are open at signup; otherwise, a waiting page explains it until approval by an operator.

If you received an invitation (from a colleague or a partner firm), simply follow its link: it keeps its own flow.

## 2. Register the application

1. In **Targets**, choose **Add a target**.
2. Enter the exact URL of the application, for example `https://app.exemple.fr`.

The exact URL is the starting point of the scope. You will be able to add other HTTPS URLs under the verified domain and explicit exclusions in the target page; nothing is added by discovery during the test.

## 3. Prove control of the domain

1. Choose a method: HTTPS file on the exact origin, or DNS TXT record on the parent domain.
2. Publish the provided code, then run the verification.

The code is valid for 72 hours; the accepted proof remains valid for 90 days. The details, including the causes of failure, are in [Verify the domain](https://docs.spectr-ai.eu/en/pentest-externe/verifier-le-domaine).

## 4. Write the Guidance

The Guidance opens once the domain is verified. Start from a template (SaaS, e-commerce, API, website), then describe the attack surface, the priorities, the strategy and prohibited techniques, the evidence requirements and the stop conditions; attach your OpenAPI, Swagger or Postman documents. Publish the Guidance: each pentest starts from the active version. See [Write the Guidance](https://docs.spectr-ai.eu/en/pentest-externe/guidance).

## 5. Order

The purchase is made from the application's page, once the ownership proof is valid and the Guidance active. Choose a one-off pentest or an annual programme, then pay by card on the hosted checkout page. The rights open on payment confirmation. See [Ordering an evaluation](https://docs.spectr-ai.eu/en/offres-et-commandes/commander).

## 6. Prepare and launch the pentest

1. In **Pentests**, choose **Prepare a pentest** and select the target.
2. Choose and order the authorised URLs, provide dedicated test accounts if needed and set the guardrails (excluded paths, rate, careful mode, start window).
3. Read and accept the five authorisation attestations.
4. Launch. An available evaluation is deducted; a valid retest is not.

See [Launch a pentest](https://docs.spectr-ai.eu/en/pentest-externe/lancer-un-pentest).

## 7. Follow the activity

The pentest page shows its phases, its duration, the latest end time, the test plan and the surfaces tested. You can cancel; a resume is only offered if the mission is eligible. See [During the test](https://docs.spectr-ai.eu/en/pentest-externe/pendant-le-test) and [Follow the activity](https://docs.spectr-ai.eu/en/pentest-externe/suivre-l-activite).

## 8. Read the results

At the end, the proven findings, their redacted HTTP evidence and the attack paths appear in **Findings** and in the pentest page. The final report is published automatically in **Reports**, downloadable as PDF and shareable through a revocable link.

## 9. Fix and have it retested

Fix, then prepare a retest batch from the findings concerned: two batches are included within the sixty days following the report. See [Correction retests](https://docs.spectr-ai.eu/en/resultats/retests).

> [!TIP]
> Before ordering, read a [sample report](https://spectr-ai.eu/en/exemple-de-rapport): it shows exactly the shape of the deliverables you will receive.

---

https://docs.spectr-ai.eu/en/demarrer/premier-pentest