Steps

Steps involved in PenTesting

Planning and Scoping Penetration Testing

There are various considerations when planning and scoping a PenTest.

• Planning

  • Target Audience [Higher Management, IT Team, Web Team, etc]
  • Resources
  • Budget
  • Technical Constraints
  • Legal Restrictions
  • Rules of Engagement
    • Timeline
    • Location of Testing
    • Test Boundaries
  • Contract
    • Master Service Agreement (MSA)
    • Non-Disclosure Agreement (NDA)
    • Statement of Work (SOW)
  • Authorizations
  • Disclaimers

• Scoping

  • Goals
  • Deliverables
  • Assessment Method
  • Strategy
  • Threat Model
  • Targets
  • Impact Analysis
  • Risk Management
  • Scheduling tasks
  • Checklists

• Preparation

  • Team Preparation
  • Activity Assignment
  • Communication Path
  • Contigency Plans
  • Going Live
  • Data Collection
  • Documentation

Perform Passive Reconnaissance

• Information Gathering using Open Source Intelligence (OSINT)
  • Methods
    • Whois Search
    • Organization Website
    • Social Media Profiles (Facebook, Instagram, YouTube, etc)
    • Job Portals
    • DNS Quering
    • SSL/TLS Certificates
    • IP Address and Subdomains
    • Google Hacking
  • Tools
    • Recon-ng
    • Shodan
    • theHarvester
    • Maltego
    • FOCA
  • Social Engineering Methods
    • Phishing (Vishing, SMSishing, Spear Phishing, Whaling)
    • Spam and Spim
    • URL Hijacking
    • Hoax
    • Baiting
    • Shoulder Surfing
    • Tailgating and Piggybacking
  • Physical Non-Technical Methods
    • Dumpster Diving
    • Badge Cloning
    • Fence Jumping
    • Lock Picking and Bypassing
    • Motion Detecton Bypassing

Perform Active Reconnaissance

• Network Scanning using Nmap and Metasploit
  • Packet Crafting
  • Port Scanning
  • Host Discovery
  • Service Discovery
• Device Enumeration
  • Banner Grabbing
  • Network Share Enumeration
  • Service and Application Enumeration
  • Windows and Linux Enumeration
  • Website Enumeration
• Vulnerability Scanning
  • Host Vulnerability
  • Service Vulnerability (Network and Server)
  • Network Device Vulnerability
  • Firewall Vulnerability
  • Application Vulnerability
  • Container Vulnerability
  • Wireless Vulnerability (WiFi)

Analyze Vulnerabilities

• Asset Categorization
• Adjudication
  • Common Vulnerability Scoring System (CVSS)
• Vulnerability Prioritization
• Vulnerability Mapping
• Exploits
  • Exploit Modification
  • Exploit Chaining
• Payloads
• PoC

Penetration to Networks

• Sniffing
• Eavesdropping
• ARP Poisioning
• Person-in-the-Middle Attack
• Replay Attack
• Protocol Level Exploits
  • SNMP
  • SMTP
  • TCP
  • ARP
  • FTP
  • DNS
• DoS Attack
• VLAN Hopping
• NAC Bypass
• Deauthentication Attack
• Jamming
• Evil Twin Attack
• Bluejacking
• Bluesnarfing

Vulnerabilities Exploitation

• Operating System Vulnerabilities
• Password Cracking
• File Systems
• Kernel
• Privilege Escalation
• Memory Vulnerabilities
• User Accounts
• Service Protocols
• Security MisConfigurations
• Authorization & Authentication
• Injection Attacks
  • Code Injection
  • SQL Injection
  • HTML Injection
• XSS
• CSRF
• File Inclusion Attacks
• Web Shells
• Insecure Coding Practices
  • Static Code Analysis (SAST)
  • Dynamic Code Analysis (DAST)
  • Reverse Engineering

Post-Exploitation

Analyze and Report PenTest Results