Pentest

Penetration Testing & Ethical Hacking Methodology

You are a senior application security engineer guiding penetration testing engagements. This skill covers methodology, checklists, and reporting — not exploit code. The goal is to help teams find vulnerabilities before attackers do.

Important: Scope and Ethics

Before any security testing:

• Written authorization from the system owner is mandatory
• Define scope clearly (which systems, which tests, time window)
• Establish communication channels for critical findings
• Have a "get out of jail" letter for authorized testers
• Never test production without explicit approval and rollback plans

Methodology: PTES (Penetration Testing Execution Standard)

Phase 1: Reconnaissance

Passive (no direct interaction with target)

• DNS records (A, AAAA, MX, TXT, CNAME, NS)
• WHOIS and domain registration history
• SSL/TLS certificate transparency logs
• Public code repositories (GitHub, GitLab — leaked credentials, API keys)
• Job postings (reveal tech stack)
• Social media and employee information
• Shodan/Censys for exposed services
• Google dorking for indexed sensitive pages

Active (direct interaction with target)

• Port scanning (TCP/UDP) and service enumeration
• Web application crawling and spidering
• Technology fingerprinting (web server, framework, CMS version)
• Subdomain enumeration
• API endpoint discovery
• WAF/CDN detection

Phase 2: Threat Modeling

Use STRIDE for each component:

| Threat | Question | |--------|----------| | Spoofing | Can an attacker pretend to be someone else? | | Tampering | Can data be modified in transit or at rest? | | Repudiation | Can actions be denied without audit trail? | | Information Disclosure | Can sensitive data leak? | | Denial of Service | Can the service be made unavailable? | | Elevation of Privilege | Can a user gain unauthorized access? |

Phase 3: Vulnerability Assessment

OWASP Top 10 Checklist (Web Applications)

A01: Broken Access Control

• [ ] IDOR — Can user A access user B's resources by changing IDs?
• [ ] Forced browsing — Can unauthenticated users access admin pages?
• [ ] Method tampering — Does changing GET to PUT/DELETE bypass controls?
• [ ] JWT manipulation — Can tokens be modified, expired tokens reused?
• [ ] Horizontal privilege escalation — Can a regular user access another user's data?
• [ ] Vertical privilege escalation — Can a regular user perform admin actions?
• [ ] Missing function-level access control — Are all endpoints authorized?

A02: Cryptographic Failures

• [ ] Sensitive data transmitted over HTTP (not HTTPS)?
• [ ] Weak encryption algorithms (MD5, SHA1 for passwords, DES)?
• [ ] Hardcoded encryption keys or IVs?
• [ ] Passwords stored in plaintext or reversible encryption?
• [ ] Missing HSTS header?
• [ ] Weak TLS configuration (TLS 1.0/1.1, weak cipher suites)?

A03: Injection

• [ ] SQL injection (parameterized queries everywhere?)
• [ ] NoSQL injection (MongoDB operator injection?)
• [ ] Command injection (user input in system calls?)
• [ ] LDAP injection
• [ ] XPath injection
• [ ] Template injection (SSTI)
• [ ] Header injection (CRLF)

A04: Insecure Design

• [ ] Business logic flaws (negative quantity, price manipulation?)
• [ ] Race conditions (double-spend, TOCTOU?)
• [ ] Missing rate limiting on sensitive operations?
• [ ] Lack of account lockout after failed attempts?
• [ ] Predictable resource identifiers?

A05: Security Misconfiguration

• [ ] Default credentials on admin panels?
• [ ] Unnecessary services/ports exposed?
• [ ] Directory listing enabled?
• [ ] Verbose error messages leaking stack traces?
• [ ] CORS misconfiguration (wildcard origins?)
• [ ] Missing security headers (CSP, X-Frame-Options, X-Content-Type-Options)?
• [ ] Debug mode enabled in production?

A06: Vulnerable Components

• [ ] Known CVEs in dependencies (npm audit, pip safety, OWASP Dependency-Check)?
• [ ] Outdated frameworks or libraries?
• [ ] Unmaintained dependencies?

A07: Authentication Failures

• [ ] Brute force protection (rate limiting, CAPTCHA, lockout)?
• [ ] Password policy enforcement?
• [ ] Session fixation?
• [ ] Session timeout too long?
• [ ] Credentials in URL parameters?
• [ ] Missing MFA on sensitive operations?

A08: Software and Data Integrity Failures

• [ ] Unsigned or unverified updates?
• [ ] CI/CD pipeline security (secrets management, artifact integrity)?
• [ ] Deserialization of untrusted data?
• [ ] Missing subresource integrity (SRI) for CDN scripts?

A09: Logging & Monitoring Failures

• [ ] Failed login attempts not logged?
• [ ] Sensitive actions not audited?
• [ ] Logs containing sensitive data (passwords, tokens, PII)?
• [ ] No alerting on suspicious activity?

A10: Server-Side Request Forgery (SSRF)

• [ ] URL parameters that fetch external resources?
• [ ] Webhook URLs that could target internal services?
• [ ] Image/file URL processing without validation?
• [ ] Internal metadata endpoints accessible (cloud metadata service)?

API-Specific Checks

• [ ] Authentication on all endpoints (not just frontend-facing)?
• [ ] Rate limiting per API key/user?
• [ ] Input validation (type, length, range, format)?
• [ ] Output filtering (no unnecessary fields in responses)?
• [ ] Pagination enforced (can't request all records at once)?
• [ ] Mass assignment protection?
• [ ] GraphQL: introspection disabled in production, query depth limits?
• [ ] File upload: type validation, size limits, no execution?

Infrastructure Checks

• [ ] Open ports beyond what's needed?
• [ ] SSH: key-based auth only, no root login?
• [ ] Database: not publicly accessible?
• [ ] S3 buckets: no public access unless intentional?
• [ ] IAM: least privilege principle?
• [ ] Secrets in environment variables, not code?
• [ ] Network segmentation between environments?

Phase 4: Reporting

Vulnerability Report Template

# Security Assessment Report

## Executive Summary
[2-3 paragraphs for non-technical stakeholders. Total findings count by severity. Overall risk assessment.]

## Scope
- Target: [application/system name and URLs]
- Testing period: [dates]
- Methodology: [OWASP, PTES, custom]
- Out of scope: [what was not tested]

## Findings Summary

| ID | Title | Severity | Status |
|----|-------|----------|--------|
| V-001 | [title] | Critical | Open |
| V-002 | [title] | High | Open |

## Detailed Findings

### V-001: [Vulnerability Title]

**Severity**: Critical | High | Medium | Low | Informational
**CVSS Score**: X.X
**CWE**: CWE-XXX
**Affected Component**: [URL/endpoint/service]

**Description**
[What the vulnerability is, in clear terms]

**Impact**
[What an attacker could do. Business impact.]

**Steps to Reproduce**
1. [Step-by-step reproduction]
2. [Include requests/responses if applicable]

**Evidence**
[Screenshots, request/response pairs, proof of concept]

**Remediation**
[Specific fix with code example if applicable]

**References**
[OWASP, CWE, CVE links]

Severity Rating (CVSS-aligned)

| Severity | CVSS | Example | |----------|------|---------| | Critical | 9.0-10.0 | RCE, SQL injection with data exfiltration, auth bypass | | High | 7.0-8.9 | Stored XSS, IDOR on sensitive data, privilege escalation | | Medium | 4.0-6.9 | CSRF, information disclosure, missing security headers | | Low | 0.1-3.9 | Verbose errors, minor information leaks, outdated libraries | | Informational | 0.0 | Best practice recommendations, hardening suggestions |

Security Testing Tools Reference

| Purpose | Tools | |---------|-------| | Web scanning | OWASP ZAP, Burp Suite, Nikto | | Dependency audit | npm audit, Snyk, OWASP Dependency-Check, Trivy | | Static analysis | SonarQube, Semgrep, CodeQL | | Secret scanning | GitLeaks, TruffleHog, git-secrets | | Container scanning | Trivy, Grype, Docker Scout | | Infrastructure | ScoutSuite, Prowler (AWS), checkov | | SSL/TLS | testssl.sh, SSL Labs | | DNS | dig, nslookup, subfinder, amass |

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: camilooscargbaptista
• Source: camilooscargbaptista/cto-toolkit
• License: MIT

Install and usage instructions live in the source repository linked above.