Overview of the Penetration testing process

0x01???? Information gathering

2. Human Resource Intelligence
   1. such as Enterprise General employee information, administrator information, mailbox, name, common user name and password, etc.
4. Enterprise Location information Collection
   1. Real IP can be determined by location and can be used for WiFi penetration
6. IP and domain name information collection
   1. Determine penetration test Range
8. Third party Resource Collection
   1. Cloud service, ISP, web hosting information
10. Server Open port Information
    1. Port-provided services, and version information
12. Server/Employee PC operating System Information
14. Web Service information provided by the server
    1. CMS and version information used by Web services
    2. Development language, language version
    3. Site path Information
    4. Is there any information leaking?
16. Identification of defense mechanisms
18. Penetration test target has exposed the vulnerability information
20. Github,google code and other open source platform information collection
22. Determination of enterprise Network boundary

0x02???? Vulnerability discovery and exploit

2. Automated vulnerability Discovery/Manual Vulnerability Discovery
4. Web application vulnerability Discovery and utilization
   1. SQL injection
   2. XSS Cross-site scripting
   3. File Upload
   4. Weak password
   5. ... Wait a minute
6. Some port software vulnerability discovery and utilization
   1. Database can be accessed remotely or with weak passwords
   2. Remote management function Weak password, such as Ssh,pcanywhere, etc.
   3. Remote overflow such as RPC
   4. ... Wait a minute
8. Whether the network boundary can break through
   1. Wifi
   2. Vpn
   3. ... Wait a minute

0x03???? Privilege elevation Phase

1. Local/Remote power-up due to system vulnerability
2. Rights of third party software
3. Right to raise rights due to improper disposition

0x04???? Permission to maintain

1. Agent
2. Port forwarding
3. Tunnel
4. Backdoor/trojan/hidden account

0x05???? Intranet Infiltration

1. Intranet Range
2. Determination of intranet topology
3. Weak password problem in intranet

0x06???? Infiltration Trace Cleanup

1. Web App log cleanup
2. Cleanup of system logs
3. Log cleanup for some services

0x07???? Summary

Information gathering is an extremely important stage in penetration testing, and every stage of penetration testing is accompanied by information gathering, which should pay special attention to the record of sensitive information.

Penetration testing is not performed in the order of the first and the last, but in an iterative process.

Overview of the Penetration testing process