Pentesting Methodology

A comprehensive guide for conducting penetration tests and security assessments. This skill provides a structured approach to security testing from initial reconnaissance through post-exploitation.

⚠️ Ethical Considerations

Always ensure you have explicit authorization before performing any security testing. This methodology should only be used:

• On systems you own or have written permission to test
• In authorized penetration testing engagements
• In controlled lab environments for learning
• During bug bounty programs within scope

Methodology Overview

Follow this structured approach for comprehensive security assessments:

Phase 0: Physical Access Assessment

If you have physical access to target systems:

• Review physical attack vectors (USB drops, keyloggers, hardware implants)
• Consider GUI escape techniques for locked workstations
• Document physical security controls and bypass opportunities

Phase 1: Asset Discovery

Internal Tests:

• Discover hosts within the network using ARP scanning, Nmap, and network enumeration
• Map network topology and identify critical infrastructure

External Tests:

• Enumerate company assets on the internet (domains, subdomains, cloud resources)
• Use OSINT tools to gather publicly available information
• Once internal access is gained, restart from Phase 1 for internal discovery

Phase 2: Network Intelligence (Internal Only)

Before targeting specific hosts:

• Passive reconnaissance: Sniff network traffic to understand protocols and data flows
• Active reconnaissance: Perform MITM attacks to intercept credentials and sessions
• Credential harvesting: Capture NTLM hashes, Kerberos tickets, or plaintext credentials
• Document network protocols, services, and potential attack surfaces

Phase 3: Port Scanning & Service Discovery

Essential scanning workflow:

1. Initial scan: Quick port scan to identify open ports
2. Service enumeration: Identify running services and versions
3. Deep scan: Comprehensive scan with version detection and script scanning
4. Documentation: Record all findings with timestamps

Recommended tools:

• Nmap for comprehensive scanning
• Masscan for rapid port discovery
• Rustscan for fast initial sweeps

Phase 4: Vulnerability Research

For each discovered service:

1. Version identification: Determine exact service versions
2. CVE lookup: Search for known vulnerabilities (Exploit-DB, NVD, GitHub)
3. Exploit availability: Check for public exploits or proof-of-concepts
4. Risk assessment: Prioritize based on severity and exploitability

Resources:

• Exploit-DB for public exploits
• NVD for CVE information
• GitHub for custom exploits and tools
• Vendor security advisories

Phase 5: Service-Specific Testing

When no direct exploits exist:

• Test for common misconfigurations
• Check for default credentials
• Test for authentication bypasses
• Look for information disclosure
• Attempt parameter tampering

Web applications (highest priority):

• SQL injection testing
• XSS vulnerability assessment
• Authentication/authorization testing
• File upload vulnerabilities
• Business logic flaws

Common services to test:

• SSH, RDP, VNC (remote access)
• SMB, NFS (file sharing)
• HTTP/HTTPS (web services)
• Database services (MySQL, PostgreSQL, MongoDB)
• Mail services (SMTP, IMAP, POP3)

Automated tools:

• Legion for automated vulnerability assessment
• Nessus/OpenVAS for vulnerability scanning
• Custom scripts for service-specific testing

Brute-force considerations:

• Use wordlists appropriate to the service
• Implement rate limiting to avoid detection
• Document all attempts for reporting
• Consider credential stuffing if hashes are available

Phase 6: Social Engineering

When technical vectors fail:

• Phishing campaigns (email, SMS, voice)
• Credential harvesting pages
• Malicious document delivery
• Business email compromise scenarios

Important: Only use social engineering with explicit authorization and within legal boundaries.

Phase 7: Initial Access

Once a vulnerability is identified:

1. Exploit development: Adapt or write exploits as needed
2. Payload delivery: Choose appropriate payload (reverse shell, bind shell, web shell)
3. Shell establishment: Gain initial interactive access
4. Stabilization: Upgrade to stable shell if needed

Reverse shell considerations:

• Choose appropriate language (bash, python, netcat, powershell)
• Consider firewall/AV evasion
• Use encrypted channels when possible
• Have backup access methods ready

Windows-specific:

• AV evasion techniques for payloads
• Use encoded or obfuscated commands
• Consider living-off-the-land binaries (LOLBins)

Phase 8: Post-Access Enumeration

Linux systems:

• User enumeration (

  /etc/passwd

  ,

  last

  ,

  w

  )
• Privilege escalation paths (SUID binaries, cron jobs, capabilities)
• Network connections and listening services
• Installed software and versions
• Scheduled tasks and startup scripts

Windows systems:

• User and group enumeration
• Service and process analysis
• Registry persistence locations
• Scheduled tasks and startup items
• Credential storage locations
• Active Directory information (if domain-joined)

Phase 9: Data Exfiltration

Data extraction methods:

• Direct file transfer (SCP, FTP, HTTP)
• Encrypted channels (DNS tunneling, HTTPS)
• Steganography for covert channels
• Compression and encoding for large datasets

Data to prioritize:

• Credentials and password hashes
• Sensitive documents and databases
• Configuration files with secrets
• Source code and intellectual property
• Network topology information

Phase 10: Privilege Escalation

Local Privilege Escalation:

Linux:

• Kernel exploits (check kernel version)
• SUID/SGID binary abuse
• Capability exploitation
• Cron job manipulation
• Service misconfigurations
• Use PEAS (Privilege Escalation Awesome Scripts) for enumeration

Windows:

• Service exploitation
• Token manipulation
• UAC bypass techniques
• Unquoted service paths
• Weak service permissions
• Use WinPEAS for enumeration

Domain Privilege Escalation:

• Active Directory enumeration
• Trust relationship exploitation
• Kerberos attacks (AS-REP roasting, Golden Ticket)
• Lateral movement techniques
• Credential dumping (Mimikatz, secretsdump)
• GPO abuse and manipulation

Phase 11: Post-Exploitation

Looting:

• Search for additional credentials
• Check for access to other systems
• Dump password hashes and cached credentials
• Look for configuration files with secrets
• Identify high-value targets

Persistence:

• Implement 2-3 different persistence mechanisms
• Windows: Scheduled tasks, services, registry run keys, WMI subscriptions
• Linux: Cron jobs, systemd services, bashrc modifications
• Active Directory: GPO modifications, ACL changes, DC shadowing
• Document all persistence for cleanup

Phase 12: Pivoting

Network pivoting:

• SSH tunneling for port forwarding
• SOCKS proxies for network access
• Meterpreter pivoting (if using Metasploit)
• Chisel/SSHuttle for advanced tunneling

Lateral movement:

• Use harvested credentials on other systems
• Pass-the-hash/Pass-the-ticket attacks
• WMI/WinRM for Windows lateral movement
• SSH key abuse for Linux environments

When pivoting:

• Restart methodology from Phase 1 for new networks
• Document network topology changes
• Update asset inventory
• Consider new attack vectors

Specialized Testing Areas

Mobile Application Testing

• Android application security assessment
• APK analysis and decompilation
• Runtime analysis and hooking
• API security testing

Binary Exploitation

• Stack-based buffer overflows
• Format string vulnerabilities
• Return-oriented programming (ROP)
• Windows-specific exploitation techniques

Cryptographic Analysis

• ECB mode vulnerabilities
• CBC-MAC weaknesses
• Padding oracle attacks
• Weak key generation and usage

Documentation & Reporting

During the engagement:

• Document all findings with timestamps
• Capture screenshots and logs
• Record commands and outputs
• Track progress through methodology phases

Final report should include:

• Executive summary for management
• Technical findings with severity ratings
• Proof-of-concept evidence
• Remediation recommendations
• Risk assessment and prioritization

Tools Reference

Reconnaissance:

• Nmap, Masscan, Rustscan
• Subfinder, Amass, Assetfinder
• Shodan, Censys for external assets

Vulnerability Assessment:

• Legion, Nessus, OpenVAS
• Nikto, WPScan for web applications
• Burp Suite for web testing

Exploitation:

• Metasploit Framework
• Custom exploit development
• Exploit-DB search tools

Post-Exploitation:

• PEAS/WinPEAS for enumeration
• Mimikatz for credential access
• BloodHound for AD analysis
• Empire/Cobalt Strike for C2

Pivoting:

• SSH tunneling
• Chisel, SSHuttle
• Proxychains for routing

Safety Reminders

1. Authorization: Never test without written permission
2. Scope: Stay within agreed boundaries
3. Timing: Avoid production impact during business hours
4. Data handling: Protect any sensitive data discovered
5. Cleanup: Remove all persistence and access methods
6. Reporting: Document everything for the client

When to Use This Skill

Use this methodology when:

• Planning a penetration test engagement
• Conducting security assessments
• Learning penetration testing techniques
• Developing security testing procedures
• Creating bug bounty testing strategies
• Performing authorized red team operations
• Documenting security testing processes

This skill provides the framework - adapt specific techniques to your target environment and engagement scope.