Penetration Testing Methodology and Execution Questions

Overview / Pre‑Engagement

• Define scope: external IP ranges, domains, cloud assets, CDN endpoints; explicit exclusions (production DB writes, physical attacks).
• Rules of Engagement: test windows, escalation contacts, allowed techniques, non‑destructive mandate, data handling, legal approvals (SoW, NDA, POA).
• Success criteria and deliverables: executive summary, technical report, remediation retest.

Reconnaissance

• Passive: WHOIS, DNS (zone transfer check), Shodan/Censys, OSINT (subdomains via crt.sh, Git leaks), email harvesting.
• Active (light): masscan for wide TCP/UDP sweep at controlled rate; nmap for service identification; HTTP enumeration (dirb/gobuster), TLS cert inspection.

Scanning Methodology

• Auth: credentialed tests if provided (read‑only accounts).
• Vulnerability scanning: authenticated Nessus/Qualys with tuned policies; follow with manual verification to remove false positives.
• Application scanning: Burp passive scan then targeted active scanning on identified apps.

Exploitation Strategy & Safety Controls

• Prioritize low‑impact verification: configuration checks, safe proof (e.g., show banner, read non‑sensitive file), CVE PoC in non‑destructive mode.
• Controls: snapshot/backups notice, test windows, rate limits, kill‑switch, avoid destructive payloads, no password spraying on locked accounts; coordinate with SOC for alert suppression/whitelisting.

Post‑Exploitation Objectives

• Prove impact without persistence: sniffing public data, demonstrate service takeover scenario via safe steps, map lateral/privilege escalation paths conceptually.
• Capture evidence (screenshots, command logs, packet captures) with hashes and timestamps.

Evidence for Reporting

• Asset inventory, vuln IDs with repro steps, PoC screenshots/logs, risk rating (CVSS + contextual likelihood), remediation steps, retest tickets.

Remediation Verification

• Provide prioritized fixes, remediations checklist, verify patches/config changes, perform targeted retest and validate via scan and manual verification.

Risk Communication

• Technical: include CVSS, exploitability, affected hosts, exact repro steps and mitigation commands.
• Non‑technical execs: one‑page summary with risk level (High/Med/Low), business impact examples, likelihood, recommended timelines and estimated effort.