Engagement Management
- Planning and scoping: rules of engagement, test windows and selecting targets
- Legal and ethical requirements: authorization letters, reporting obligations, regulatory compliance
- Collaboration and communication: aligning with stakeholders, peer reviews, escalation paths, presenting risks clearly
- Pentest reports: executive summary, findings and remediation recommendations
Reconnaissance and Enumeration
- Active and passive reconnaissance: Open Source Intelligence (OSINT), network sniffing and protocol scans
- Enumeration: DNS enumeration, service discovery, directory enumeration
- Tools such as Nmap, Wireshark and Shodan for information gathering
- Adapt scripts in Python, PowerShell and Bash for reconnaissance and enumeration
Vulnerability Discovery and Analysis
- Vulnerability scans: authenticated and unauthenticated, Static and Dynamic Application Security Testing (SAST, DAST)
- Analyse results: validate findings, check configurations, identify false positives
- Tools such as Nessus, Nikto and OpenVAS
Attacks and Exploits
- Network attacks: VLAN hopping, on-path attacks, exploiting services
- Attacks on authentication: brute force, pass-the-hash, credential stuffing
- Host-based attacks: privilege escalation, process injection, credential dumping
- Attacks on web applications: SQL injection, cross-site scripting (XSS), directory traversal
- Attacks in the cloud: container escapes, attacks on metadata services, misconfigured IAM
- Attacks on AI systems: prompt injection and model manipulation
Post-Exploitation and Lateral Movement
- Establish persistence, move laterally through the network and clean up artefacts
- Documentation: describe the attack path clearly and give remediation recommendations
