account_tree STANDARDIZED OFFENSIVE & DEFENSIVE LIFECYCLE

Penetration Testing Methodology

A professional 12-stage ethical security assessment pipeline mapped directly to NIST SP 800-115, PTES, and OWASP frameworks, followed by a tri-perspective Attack / Detection / Defense matrix for 10 critical vulnerability classes.

Jump to 12-Stage Pipeline ↓ Jump to Attack / Detection / Defense Matrix ↓

01. The 12-Stage Assessment Pipeline

Scope → Retesting with tooling, commands, and telemetry mapping

STAGE 01 contract

Scope & Rules of Engagement

Establishing formal written authorization, Rules of Engagement (ROE), testing windows, emergency contact protocols, in-scope IP CIDRs/domains, and explicitly out-of-scope production assets.

Key Artifacts:

Signed SOW, NDA, Emergency Escalation Matrix

STAGE 02 radar

Reconnaissance (Passive OSINT)

Harvesting publicly available domain records, Certificate Transparency logs, employee emails, leaked credentials, and Shodan asset telemetry without direct packet interaction.

Tools & Commands:

subfinder, theHarvester, crt.sh, Shodan

STAGE 03 search_insights

Active Enumeration & Probing

Port scanning, protocol interrogation, web directory fuzzing, SMB share inspection, and RPC endpoint queries to map open services and software versions.

Tools & Commands:

nmap -sC -sV, ffuf, gobuster, smbclient

STAGE 04 pest_control

Vulnerability Discovery

Cross-referencing enumerated banners with CVE databases, Exploit-DB, and security advisories to detect outdated daemons and known unpatched flaws.

Tools & References:

searchsploit, NVD, VulnDB, cve.mitre.org

STAGE 05 fact_check

Vulnerability Validation (PoC)

Eliminating false positives through benign, non-destructive validation probes (e.g. confirming version behavior via harmless curl headers or time delays).

Approach:

Manual Proof of Concept (Zero DoS risk)

STAGE 06 bolt

Controlled Exploitation

Executing authorized, controlled exploits to demonstrate verifiable business risk and establish initial foothold within agreed engagement constraints.

Tools & Frameworks:

Metasploit, Burp Repeater, custom Python PoCs

STAGE 07 upgrade

Privilege Escalation

Auditing local host configurations, SUID binaries, misconfigured sudoers, cron permissions, and kernel versions to escalate from low-privilege service accounts to root/admin.

Commands & Hub:

sudo -l, SUID find, GTFOBins, LinPEAS

STAGE 08 hub

Post-Exploitation & Pivoting

Evaluating the blast radius: examining internal dual-homed network interfaces, database connection strings, and credential caches to demonstrate lateral movement potential.

Concepts:

SSH local port forwarding, Chisel, ProxyChains

STAGE 09 photo_camera

Evidence Collection & Chain

Capturing exact terminal logs, HTTP request/response pairs, timestamps, and hashes. Documenting precise steps to reproduce findings without ambiguous claims.

Integrity Rule:

SHA256 evidence hashing, timestamped logs

STAGE 10 description

Technical Reporting & CVSS

Translating technical findings into actionable executive summaries and detailed developer remediation guides with standardized CVSS v3.1/v4.0 risk scoring and CWE references.

Standard:

Executive Summary + CVSS Vector Breakdown

STAGE 11 build_circle

Remediation Guidance

Collaborating with engineering teams to provide robust code-level patches, WAF rules, and configuration changes rather than superficial band-aids.

Defense:

Parameterized queries, CSP, least-privilege IAM

STAGE 12 verified

Retesting & Attestation

Re-executing the original proof of concept against updated staging/production code to verify that the vulnerability is closed and no regression flaws were introduced.

Outcome:

Official Letter of Attestation & Clean Bill

02. Attack / Detection / Defense Matrix

Three-perspective engineering analysis for 10 major vulnerabilities: how attackers test and validate in authorized labs, what defenders observe in SIEM/WAF telemetry, and how engineers remediate the root cause in code.

VULN 01

Cross-Site Scripting (XSS - Reflected & Stored)

CWE-79

bolt Offensive View (Authorized Lab)

Inject benign probes like <script>alert(1)</script> or event handlers " onfocus="alert(1) into input fields. Verify if browser parses input as active JavaScript rather than text.

visibility Detection View (Defender)

WAF rule alerts on <script>, javascript:, and onerror= in HTTP query strings. CSP violation report sent to report-uri endpoint.

shield Defense View (Remediation)

Context-aware output encoding (DOMPurify, HTML entity encoding), store session cookies with HttpOnly; Secure; SameSite=Strict, and deploy strict CSP without 'unsafe-inline'.

VULN 02

SQL Injection (SQLi)

CWE-89

bolt Offensive View

Send single quote ' or Boolean payloads ' OR 1=1--. Observe database syntax errors or altered query results. Use UNION to extract schema metadata.

visibility Detection View

Database server logs showing SQL syntax errors (MySQL error 1064). WAF signatures flagging keywords UNION SELECT, information_schema, or SQL comments -- -.

shield Defense View

Strict parameterized queries (PreparedStatements) across all database adapters. Apply database user least privilege (read-only where possible).

VULN 03

Cross-Site Request Forgery (CSRF)

CWE-352

bolt Offensive View

Host an external webpage with an auto-submitting HTML form targeting a sensitive state-changing action (e.g. POST /email/change) without an anti-CSRF token.

visibility Detection View

HTTP request Referer or Origin header mismatch compared to target Host domain.

shield Defense View

Cryptographically random Synchronizer Token Pattern, validate Origin headers, and enforce SameSite=Lax or Strict on session cookies.

VULN 04

Insecure Direct Object Reference (IDOR)

CWE-639

bolt Offensive View

Log in as User A, request object ID of User B via URL parameter or JSON body (e.g. GET /document?id=5001). If data returns with HTTP 200, IDOR is confirmed.

visibility Detection View

Application audit logs show sequential iteration of numeric object IDs by a single authenticated session within short intervals.

shield Defense View

Enforce record-level authorization in API middleware: verify object.owner_id === req.user.id before returning database records. Use random UUIDv4.

VULN 05

Server-Side Request Forgery (SSRF)

CWE-918

bolt Offensive View

Supply internal loopback addresses (http://127.0.0.1:8000/) or cloud metadata endpoints (http://169.254.169.254/latest/meta-data/) to webhook or URL-import fields.

visibility Detection View

Outbound connection attempts from web servers to RFC 1918 private subnets or link-local addresses logged in firewall traffic flows.

shield Defense View

Strict domain allowlists, resolve DNS and block private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.1), and enforce IMDSv2 in cloud hosts.

VULN 06

Path Traversal & LFI

CWE-22

bolt Offensive View

Inject directory traversal sequences like ../../../../etc/passwd or URL-encoded %2e%2e%2f into file-download or template-loading parameters.

visibility Detection View

Web server access logs capturing .. patterns in URI path. System audit logs tracking web server process reading sensitive files outside docroot.

shield Defense View

Use an allowlist of permitted filenames, strip path characters using basename(), or verify canonical paths with realpath() against base directory.

VULN 07

Remote Command Injection (CMDi)

CWE-78

bolt Offensive View

Append shell metacharacters (;, &&, |, `whoami`) into fields passed to system execution functions like exec() or system().

visibility Detection View

EDR / Sysmon alerts detecting web server process (nginx, php-fpm, node) spawning shell processes (/bin/sh, cmd.exe).

shield Defense View

Avoid calling system shells. Use native API libraries instead of invoking shell commands. If execution is mandatory, pass arguments as discrete arrays without shell interpolation.

VULN 08

Broken Authentication & Brute Force

CWE-287

bolt Offensive View

Perform automated dictionary attacks or credential stuffing without triggering account lockouts or CAPTCHA barriers. Exploit password reset token predictability.

visibility Detection View

High frequency of HTTP 401 Unauthorized responses originating from single IP subnets or targeting sequential username lists.

shield Defense View

Mandatory Multi-Factor Authentication (MFA / FIDO2), rate limiting via IP and username, progressive delays on failed attempts, and secure password hashing (Argon2id).

VULN 09

Linux SUID & Sudo Misconfigurations

CWE-250

bolt Offensive View

Check sudo -l and search for SUID binaries with GTFOBins bypasses. Abuse writable cron jobs or PATH hijacking to run commands as root.

visibility Detection View

Auditd records execve syscalls where euid=0 from non-root parent process trees. Sudo executions logged in /var/log/auth.log.

shield Defense View

Strip unnecessary SUID bits (chmod u-s), restrict sudo rules to specific executables without wildcards, and mount /tmp with nosuid,noexec.

VULN 10

Default & Weak Credentials

CWE-1392

bolt Offensive View

Test factory default usernames and passwords on appliances, routers, database engines, and management panels (e.g. admin:admin, root:toor, tomcat:s3cret).

visibility Detection View

Successful logins to privileged accounts occurring from previously unseen external IP addresses or during off-business hours.

shield Defense View

Force password change on initial system boot, enforce minimum 16-character password complexity, and disable standard vendor default accounts.