Complete Penetration Testing Process and Methodology
·· reads0
AI TranslationSimplified ChineseEnglish
Key Insights
This text outlines a structured penetration testing methodology in seven phases. It begins with pre-engagement planning, emphasizing legal authorization, defining the testing scope (black/white/grey box), and setting rules of engagement. The second phase covers passive and active information gathering to map the attack surface, including domain and subdomain discovery, search engine use, and port scanning. Next, it details threat modeling to plan attack paths and identify high-value targets. The core phases involve vulnerability analysis and verification, exploiting weaknesses to gain initial access, and then post-exploitation activities like privilege escalation, lateral movement, and establishing persistence. The final phase is report writing and delivery. Throughout, the text stresses the importance of authorization, careful planning, and avoiding disruption to business operations.
I. Pre-Engagement and Planning
Core principle: Draw clear safety lines within legal and business boundaries, and define the depth and limits of testing.
Sign Authorization and Confidentiality Agreements
Define test IPs, domains, and API endpoints
— testing without authorization is illegal.
Define Test Type and Scope
Specify black-box, white-box, or gray-box; list asset inventories, e.g., *.target.com, 10.0.0.0/24.
The scope dictates where your reconnaissance begins — in a white-box test, you may even receive architecture diagrams and test accounts upfront.
Set Rules of Engagement and Emergency Contacts
Restrictions: No DDoS, no social engineering, no physical intrusion. Clarify whether privilege escalation, lateral movement, or data exfiltration is permitted. Designate a 24/7 emergency contact.
The goal is to avoid incidents; high-risk actions like privilege escalation require explicit approval.
Schedule the Test Window
Run tests outside peak business hours, e.g., 2:00 AM–5:00 AM.
Deliver the final testing agreement and obtain sign-off from both parties.
II. Information Gathering (Reconnaissance)
Core principle: The broader the attack surface, the more entry points you have. Build a digital portrait of the target quietly, without raising alarms.
2.1 Passive Information Gathering
2.1.1 Domain Registration Information
Approach:
Registrant email addresses can seed social engineering wordlists.
SPF records often leak the mail gateway IP, opening a door into the email system.
2.1.2 Subdomain Discovery
Approach: Subdomains commonly host edge services and test systems with weak defenses — they are the preferred initial foothold.
2.1.3 Search Engine Exploitation
Approach: Use search engines to directly uncover documents that may contain passwords and accessible directories — no scanning required.
2.1.4 Public Code Repositories and Cloud Storage
Approach: Credentials and config files accidentally uploaded by developers are a fast track straight in.
2.1.5 Employees and Email Formats
Approach: Use for password spraying, phishing, or building username enumeration lists.
2.1.6 Cyberspace Search Engines
Approach: Find directly exposed open ports, service banners, and known CVEs.
2.1.7 Historical Data and Snapshots
Approach: Decommissioned test interfaces may still be accessible or offer useful clues.
2.2 Active Information Gathering
2.2.1 Host Discovery
Tool: nmap
Approach: Determine which hosts are alive to narrow the scope for subsequent scanning.
2.2.2 Port Scanning and Service Identification
Tool: nmap
Approach: Full-port SYN scan is fast; use -sV to grab detailed service versions for vulnerability matching.
2.2.3 OS Fingerprinting
Tool: nmap
Approach: Knowing the OS lets you pick the precise privilege-escalation exploit.
I. Pre-Engagement and Planning
Core principle: Draw clear safety lines within legal and business boundaries, and define the depth and limits of testing.
II. Information Gathering (Reconnaissance)
Core principle: The broader the attack surface, the more entry points you have. Build a digital portrait of the target quietly, without raising alarms.
2.1 Passive Information Gathering
2.1.1 Domain Registration Information
Approach:
2.1.2 Subdomain Discovery
Approach: Subdomains commonly host edge services and test systems with weak defenses — they are the preferred initial foothold.
2.1.3 Search Engine Exploitation
Approach: Use search engines to directly uncover documents that may contain passwords and accessible directories — no scanning required.
2.1.4 Public Code Repositories and Cloud Storage
Approach: Credentials and config files accidentally uploaded by developers are a fast track straight in.
2.1.5 Employees and Email Formats
Approach: Use for password spraying, phishing, or building username enumeration lists.
2.1.6 Cyberspace Search Engines
Approach: Find directly exposed open ports, service banners, and known CVEs.
2.1.7 Historical Data and Snapshots
Approach: Decommissioned test interfaces may still be accessible or offer useful clues.
2.2 Active Information Gathering
2.2.1 Host Discovery
Tool: nmap
Approach: Determine which hosts are alive to narrow the scope for subsequent scanning.
2.2.2 Port Scanning and Service Identification
Tool: nmap
Approach: Full-port SYN scan is fast; use -sV to grab detailed service versions for vulnerability matching.
2.2.3 OS Fingerprinting
Tool: nmap
Approach: Knowing the OS lets you pick the precise privilege-escalation exploit.
2.2.4 Initial Vulnerability Scanning
Tools: nmap, AWVS, Nessus, OpenVAS, dedicated vulnerability scanners
Approach: Automate the discovery of known vulnerabilities, but always verify manually to eliminate false positives.
2.2.5 Common Service Enumeration
SMB, SNMP, web directory brute-forcing, DNS zone transfer attempts
Once this phase is complete, organize and thoroughly analyze all collected results before moving on.
III. Threat Modeling and Attack Path Planning
Core principle: Assemble an attack tree from the gathered intelligence and prioritize the path of least resistance.
3.1 Map the Attack Surface
Action: Categorize discovered ports, services, web entry points, email addresses, usernames, etc., and sketch out the topology.
Approach:
3.2 Identify High-Value Targets
Action: Identify domain controllers, database servers, code repositories, VPN gateways, and core business web applications.
Approach: Compromising a domain controller gives you control over the entire domain; hitting the database gives direct access to business data.
3.3 Select Initial Attack Vectors
Common paths:
Approach: The starting point of every attack chain must be stable and stealthy.
3.4 Develop a Contingency and Rollback Plan
Approach: If an exploit crashes a service, roll back immediately and document everything to avoid business impact.
IV. Vulnerability Analysis and Verification
Core principle: Manually verify scan results, filter out the noise, and build working POCs.
4.1 Web Vulnerability Verification
4.1.1 Injection (SQL Injection)
Approach: First identify dynamic parameters, then attempt error-based or time-based blind injection.
4.1.2 Cross-Site Scripting (XSS)
Approach: Typically used to steal cookies, often chained with CSRF.
4.1.3 File Inclusion / Upload
Action: Attempt path traversal with ../../etc/passwd; upload an image containing a one-liner web shell.
Approach: File upload is one of the best ways to grab a shell directly.
4.1.4 Command Injection
Actions:
Approach: With any echo or out-of-band channel, you can execute system commands directly.
4.1.5 Logic Flaws
Actions: Modify monetary values, enumerate IDs, submit duplicates, brute-force CAPTCHAs, reset any password, and exploit various privilege-escalation or unauthorized-access flaws (JWT manipulation, etc.).
Approach: Exploit logic errors to bypass controls directly — no complex techniques needed.
V. Exploitation (Gaining Initial Access)
Core principle: Use verified vulnerabilities to break through and establish a stable control channel.
5.1 Generate Payloads
Tailor payloads to the target OS and architecture, and apply evasion to bypass antivirus.
There are plenty of evasion tools available.
5.2 Upload WebShell via Web Vulnerabilities
Approach: Gain web-server-level access, then escalate to a reverse shell.
Upload a one-liner Trojan via file upload, or write a web shell through command injection.
5.3 Exploit Remote Code Execution Vulnerabilities
Struts2, Log4j, EternalBlue — run the corresponding Metasploit module directly to get a Meterpreter session.
Approach: Rapidly obtain maximum privileges; pay attention to stability and backdoor deployment.
5.4 Log In via Weak Credentials and Execute Commands
Action: After SSH or RDP login, upload your toolkit; use WinRM and WMI for remote execution.
Approach: Immediately collect basic system information upon login and maintain long-term access.
5.5 Establish Redundant Connections
Examples: scheduled tasks and similar mechanisms to maintain backup reverse shells.
Approach: Avoid losing everything to a single dropped connection.
VI. Post-Exploitation (Lateral Movement and Persistence)
Core principle: Simulate how a real attacker spreads through the internal network and demonstrate the most damaging attack paths.
6.1 Local Information Gathering
6.2 Privilege Escalation
6.3 Lateral Movement
6.4 Persistence
6.5 Covering Tracks
VII. Reporting and Delivery
There are templates — just follow them.
Current job market: everyone is hiring for web security, nothing else.