Penetration Testing Methodology

Penetration Testing Methodology

The overall penetration testing methodology is something that one develops over time. As my methodology is still being developed, this methodology is probably going to have holes and will not cover everything. It will most likely change as well.

Important Notes

When you are in the Information Gathering phases (yes, you will go through information gathering multiple times), do not jump out of that phase to the exploit phase until you are finished with harvesting all that you can. While in the Information Gathering phase note "Things to try later" so you have a list of possible things you can attempt to exploit. This can help avoid being stuck in rabbit holes for too long.

Methodology Outline

• Recon

• Vulnerability Research

• Exploit Development

• Exploitation

• Initial Access

• Persistence

• Privilege Escalation

  • Windows Privilege Escalation

  • Linux Privilege Escalation

• Lateral Movement

• Covering Tracks

• Exfiltration

Each "step" does not strictly follow the one before it. There are occasions where some steps may be completely skipped (Privilege Escalation, Lateral Movement, Covering Tracks, Exfiltration) because they are not required for that particular engagement.

Tips

Here are some tips to consider:

• Complete one phase before moving on to the next.

  • Do not try start exploit research until you have completed information gathering.

• Reflect on what you know about the system.

• Think about your assumption and question them.

• Develop hypothesis and challenge them.

  • What is/are your assumption(s) about the machine?

  • What is your evidence?

  • How confident are you that the assumptions are correct?

  • What can you do to test your assumptions? (Try to disprove them.)

• Take a break around every 90 minutes.

• Reflect on what you know and your assumptions frequently.

  • At least do this between each phase.

• Don't skip code analysis.

• Always get the most interactive and robust shell possible before escalating privileges.