Penetration Testing Methodology & Authorization

Overview

Penetration Testing Methodology & Authorization establishes the ethical, legal, and procedural standards that distinguish authorized security testing from unlawful cyber attacks. A formal security assessment follows recognized industry frameworks (such as PTES - Penetration Testing Execution Standard) to ensure comprehensive vulnerability coverage, minimal operational disruption, and actionable remediation reporting.

Core Concepts

• Rules of Engagement (ROE): The binding legal contract defining authorized target IP addresses, approved testing time windows, prohibited testing techniques (such as denial-of-service), and emergency contact procedures.
• Standard Assessment Phases (PTES):
  1. Pre-engagement Interactions: Scoping, legal contracts, and objective definition.
  2. Intelligence Gathering: Passive reconnaissance and network surface mapping.
  3. Threat Modeling: Identifying probable threat actors and high-value target assets.
  4. Vulnerability Analysis: Detecting and validating exploitable flaws.
  5. Exploitation: Controlled validation to confirm exploitability without causing operational damage.
  6. Post-Exploitation: Assessing potential business impact and data risk.
  7. Reporting: Documenting executive risk, technical findings, evidence, and remediation roadmaps.
• CVSS Severity Scoring: Standardized vulnerability rating system evaluating Exploitability metrics (Attack Vector, Attack Complexity, Privileges Required, User Interaction) and Impact metrics (Confidentiality, Integrity, Availability).

Tools & Requirements

Documentation tools (Markdown, LaTeX), CVSS v3.1 calculators, and reporting templates.

Commands & Practical Examples

1. Calculating CVSS v3.1 Vulnerability Scores

Understanding the standard CVSS vector string format:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H  (Base Score: 9.8 - Critical)

AV:N  = Attack Vector: Network
AC:L  = Attack Complexity: Low
PR:N  = Privileges Required: None
UI:N  = User Interaction: None
S:U   = Scope: Unchanged
C:H   = Confidentiality Impact: High
I:H   = Integrity Impact: High
A:H   = Availability Impact: High

2. Technical Finding Report Template

A standardized Markdown template for documenting security findings in laboratory and educational exercises:

### [SEC-01] Unauthenticated SQL Injection in Authentication Portal

- **Severity:** High (CVSS 8.1 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
- **Target Asset:** http://192.168.1.10/login.php
- **Vulnerability Class:** CWE-89 (SQL Injection)

#### Description
The login form concatenates unsanitized user input directly into a backend SQL query.

#### Proof of Concept (Evidence)
Submitting payload `' OR 1=1-- -` into the username field bypassed authentication.

#### Business & Technical Impact
An attacker can bypass authentication controls and access administrative records.

#### Remediation Guidance
Implement parameterized queries using PDO prepared statements.

Practical Workflow

1. Pre-Engagement: Confirm signed authorization and verify testing IP range.
2. Reconnaissance & Scanning: Systematically map open ports and services without exceeding scope.
3. Vulnerability Discovery: Correlate running versions against CVE records and configuration checks.
4. Controlled Validation: Safely verify proof-of-concept evidence.
5. Immediate Reporting: Document evidence screenshots, CVSS vectors, and specific remediation steps.

Common Mistakes & Troubleshooting

• Out-of-Scope Activity: Scanning subdomains or IP addresses not explicitly enumerated in the scoping agreement.
• Vague Remediation Advice: Telling developers to "fix the code" without supplying specific code examples (e.g. prepared statements or secure header configurations).

Security Considerations & Scoping

Ethics is the central differentiator in cybersecurity. Always ensure that evidence data, captured hashes, and technical reports are encrypted both at rest and in transit.

Related Topics

• Module 05: Web Application Security Fundamentals
• Module 10: Reconnaissance & Surface Enumeration
• Module 13: AI & Agentic Workflows in Cybersecurity

Further Reading & TryHackMe Paths

• TryHackMe Path: Jr Penetration Tester (Methodology & Assessment Foundations).
• PDF Library: Refer to Chapter_2_Part_7_Output_Formats.pdf and metasploit-framework/c8.pdf in the PDF Download Library.