HTB CPTS: Pre-Engagement Stage

It’s a stage where we prepare for the actual pentesting. It’s a place to ask questions. As many as you can.

It’s also a stage where we communicate with our client. We ask what needs does he have. After that we make a Kick-Off meeting.

To start any of the process you need to first sign Non-Disclosure Agreement (NDA).

We must know who in the company is permitted to contract us for a penetration test. There can be employees who wants to do sabotage against the company that they work for.

There are some documents that we need to prepare:

These documents should be reviewed by a lawyer after preparation.

We also need to be sure that we can deliver the assessment our client requires.

Here’s a list of questions that are worth of being asked:

Final question to ask is what kind of pentest it will be - black box, grey box or white box?

This information is important for us to determine the timeline.

After that we prepare a Scoping Document.

Pre-Engagement Meeting

This meeting discusses all relevant and essential components with our customer before the penetration test. We explain them to our customer.

This phase typically occurs via e-mail and during an online conference call or in-person meeting.

We may encounter clients during our career that are undergoing their first ever penetration test, or the direct client PoC (Proof Of Concept) is not familiar with the process. It is not uncommon to use part of the pre-engagement meeting to review the scoping questionnaire either in part or step-by-step.

Other important parts

• It is important to get written agreements from third parties that they are aware of the penetration test happening

• It’s also important to determine Limitations and restrictions.

• We must prioritize our client’s wishes. Don’t do more than our client wants.

Rules of Engagement

Here’s a check list for the Rules of Engagement:

Checkpoint	Contents
Introduction	Description of this document.
☐ Contractor	Company name, contractor full name, job title.
☐ Penetration Testers	Company name, pentesters full name.
☐ Contact Information	Mailing addresses, e-mail addresses, and phone numbers of all client parties and penetration testers.
☐ Purpose	Description of the purpose for the conducted penetration test.
☐ Goals	Description of the goals that should be achieved with the penetration test.
☐ Scope	All IPs, domain names, URLs, or CIDR ranges.
☐ Lines of Communication	Online conferences or phone calls or face-to-face meetings, or via e-mail.
☐ Time Estimation	Start and end dates.
☐ Time of the Day to Test	Times of the day to test.
☐ Penetration Testing Type	External/Internal Penetration Test/Vulnerability Assessments/Social Engineering.
☐ Penetration Testing Locations	Description of how the connection to the client network is established.
☐ Methodologies	OSSTMM, PTES, OWASP, and others.
☐ Objectives / Flags	Users, specific files, specific information, and others.
☐ Evidence Handling	Encryption, secure protocols
☐ System Backups	Configuration files, databases, and others.
☐ Information Handling	Strong data encryption
☐ Incident Handling and Reporting	Cases for contact, pentest interruptions, type of reports
☐ Status Meetings	Frequency of meetings, dates, times, included parties
☐ Reporting	Type, target readers, focus
☐ Retesting	Start and end dates
☐ Disclaimers and Limitation of Liability	System damage, data loss
☐ Permission to Test	Signed contract, contractors agreement

---

• We must also inform our customers about potential risks during a penetration test

• We must say that customers must contact us immediately if the penetration test performed negatively impacts their network.

• Explaining process demonstrates our professional approach.

Contractors Agreement

If pentest is also physcial, different kind of laws apply here. We need to sign another agreement as “get out of jail for free” card.

Here’s a checklist:

Outro

I’m learning for a HTB CPTS certificate. Information that you’ve read is my knowledge base for the future.

I invite you to check Hack The Box for amazing courses and challenges.