Table of Contents
1. Penetration Testing Methodology
Legal Notice
Penetration tests may only be performed with explicit written permission. Unauthorized testing is illegal and may have criminal consequences.
PTES (Penetration Testing Execution Standard)
Pre-Engagement
Scope Definition, Legal Agreements, Rules of Engagement
Intelligence Gathering
OSINT, Reconnaissance, Information Collection
Threat Modeling
Attack Vectors, Asset Valuation, Threat Analysis
Vulnerability Analysis
Scanning, Enumeration, Weakness Identification
Exploitation
Proof of Concept, Access Gaining, Privilege Escalation
Reporting
Documentation, Risk Assessment, Remediation
2. Planning & Reconnaissance Phase
OSINT (Open Source Intelligence)
Information Gathering Checklist
Domain Intelligence
- • Subdomain Enumeration
- • DNS Records Analysis
- • WHOIS Information
- • Certificate Transparency Logs
- • Email Addresses
Technical Intelligence
- • Technology Stack Identification
- • Public Code Repositories
- • Social Media Profiles
- • Job Postings Analysis
- • Leaked Credentials
Reconnaissance Tools & Commands
# Subdomain Enumeration
subfinder -d target.com -o subdomains.txt
amass enum -d target.com
assetfinder target.com
# DNS Reconnaissance
dig target.com ANY
dnsrecon -d target.com -t std
fierce -dns target.com
# Port Scanning (Initial)
nmap -sn 192.168.1.0/24
masscan -p1-65535 192.168.1.1 --rate=1000
# Web Technology Detection
whatweb target.com
wafw00f target.com
wappalyzer target.com3. Scanning & Enumeration
Scanning Strategy
Start with passive scans and progress to active scans. Document all findings systematically.
Nmap Scanning Techniques
Target Discovery
# Host Discovery
nmap -sn 192.168.1.0/24
nmap -PS22,80,443 192.168.1.0/24
# TCP SYN Scan (Stealth)
nmap -sS -T4 -p- target.com
# Service Version Detection
nmap -sV -sC -p 1-65535 target.com
# UDP Scan (Top 1000 ports)
nmap -sU --top-ports 1000 target.comService Enumeration
# HTTP/HTTPS Enumeration
gobuster dir -u http://target.com -w /usr/share/wordlists/dirb/common.txt
nikto -h http://target.com
dirb http://target.com
# SMB Enumeration
enum4linux target.com
smbclient -L //target.com
smbmap -H target.com
# FTP Enumeration
nmap --script ftp-anon,ftp-bounce,ftp-libopie -p 21 target.com4. Exploitation & Post-Exploitation
Exploitation Ethics
Only perform proof-of-concept exploits. Avoid causing damage to the target system. Document all steps for the report.
Common Attack Vectors
Web Application Attacks
- • SQL Injection (SQLi)
- • Cross-Site Scripting (XSS)
- • Cross-Site Request Forgery (CSRF)
- • Local/Remote File Inclusion
- • Server-Side Request Forgery (SSRF)
- • Insecure Direct Object References
System-Level Attacks
- • Buffer Overflow Exploits
- • Privilege Escalation
- • Weak Service Configurations
- • Default Credentials
- • Unpatched Vulnerabilities
- • Misconfigured Services
Post-Exploitation Activities
# System Information Gathering
uname -a
cat /etc/passwd
ps aux
netstat -tulpn
# Privilege Escalation Check
sudo -l
find / -perm -u=s -type f 2>/dev/null
getcap -r / 2>/dev/null
# Network Reconnaissance
arp -a
route -n
cat /etc/hosts
# Data Exfiltration (Proof of Concept only)
find / -name "*.txt" -o -name "*.doc" -o -name "*.pdf" 2>/dev/null
locate password
grep -r "password" /var/log/ 2>/dev/null5. Reporting & Documentation
Report Structure
Executive Summary
- • High-level overview of findings
- • Risk assessment matrix
- • Business impact analysis
- • Strategic recommendations
Technical Details
- • Detailed vulnerability descriptions
- • Proof-of-concept evidence
- • CVSS scoring and classification
- • Step-by-step reproduction guides
Remediation
- • Prioritized remediation roadmap
- • Technical implementation guides
- • Compliance mapping (OWASP, NIST)
- • Timeline recommendations
Risk Classification
CRITICAL
9.0 - 10.0
HIGH
7.0 - 8.9
MEDIUM
4.0 - 6.9
LOW
0.1 - 3.9
6. Essential Penetration Testing Tools
Reconnaissance Tools
NmapNetwork Discovery & Port Scanning
MasscanHigh-Speed Port Scanner
GobusterDirectory/File Enumeration
SubfinderSubdomain Discovery
Exploitation Tools
MetasploitExploitation Framework
Burp SuiteWeb Application Testing
SQLmapSQL Injection Testing
John the RipperPassword Cracking
G-Data Security Tools
G-Data Endpoint ProtectionBehavioral Analysis & Detection
G-Data Security AwarenessPhishing Simulation Platform
G-Data Network SecurityAdvanced Threat Protection
Reporting Tools
DradisCollaboration & Reporting
FaradayVulnerability Management
MagicTreeData Correlation
SerpicoReport Generation
Thalvos Cloud Penetration Testing Services
As certified G-Data Security partners, we offer professional penetration tests with German security standards.
Web App Pentests
OWASP Top 10 compliance
Network Pentests
Infrastructure Assessment
Mobile App Tests
iOS & Android Security