HTB CPTS: Penetration testing process

Search for a command to run...

Can I help you?
In this series I'm preparing for highly hands on certification - Hack The Box Certified Penetration Testing Specialist.
What is Enumeration? It is one of the most important parts of Penetration Testing process. It is identifying all of the ways we could attack a target. We must do our best in this phase. Long story short - enumeration is collecting as much information...
Intro IoT nowadays is everywhere. Now there’s about 20 billion IoT devices. In 2031 there will be around 35 billion IoT devices connected to the internet. Interesting information about IoT devices & other stuff When more network devices we have and m...

Intro When I was learning cybersecurity topics in the past year, I’ve grasped lots of different tools and techniques. Some of the most iconic for me were: CAN BUS (controller area network) Radio Frequency Cryptography I was lucky to have an oppo...

What is Enumeration? It is one of the most important parts of Penetration Testing process. It is identifying all of the ways we could attack a target. We must do our best in this phase. Long story short - enumeration is collecting as much information...

Transferring files During any penetration testing exercise, it is likely that we will need to transfer files to the remote server. There are few options for this: One method is running a Python HTTP server on our machine and then using wget or cUR...

Privilege Escalation Once we gain initial access to a box, we want to thoroughly enumerate the box to find any potential vulnerabilities we can exploit to achieve a higher privilege level. There are checklists for privilege escalation online. A goo...

Cyber Journey
41 posts
Penetration testing is not only “cool hacking” actions and stunning results. It’s a process which has many stages.
There’s no step by step process in pentesting. There are stages.
Each stage builds on the other
Stages of the Penetration Testing:
Pre-engagement
It’s a stage for educating the client and adjusting the contract
Information gathering
Describes how to obtain information about the necessary components in various ways.
Looking for potential security gaps
Vulnerability Assessment
We analyze results from our Information Gathering stage
We look for knows vulnerabilities in the systems
Exploitation
We use the results to test our attacks against the potential vectors.
We try to gain initial access to the systems.
Post-Exploitation
At this stage we have access to the exploited machine.
We may try to escalate our privileges to obtain the highest possible rights.
We may hunt for sensitive data. For example credentials or other data.
Lateral Movement
Proof-of-Concept
In this stage we document the steps we took to achieve network compromise.
It is important do document our finding well, because company then can fix those gaps and they see the importance of every vulnerability fix.
We prove that the vulnerabilities exist.
Post-engagement
Detailed documentation is prepared now.
We clean up all traces of our actions on all hosts and servers.
We create the deliverables for our client.
Report walkthrough meeting is set up.
In the next article we’ll look at teach of the stages in detail.