CAP-PL ENS cheat sheet

Scope discipline: written authorization must name targets, IP ranges, time windows, and allowed techniques; any test outside that boundary is unauthorized regardless of intent.

Rules of engagement (RoE) items to confirm before first packet: emergency contact, testing hours, prohibited techniques (DoS, social engineering, physical), data-handling rules, and deconfliction for blue-team alerts.

Methodology order: passive OSINT → active enumeration → vulnerability identification → controlled exploitation → post-exploitation (privilege escalation, lateral movement, persistence) → cleanup → reporting.

Privilege escalation triage on Linux: check sudo -l, SUID/SGID binaries, cron jobs, writable service files, kernel version, and capabilities before attempting kernel exploits.

Privilege escalation triage on Windows: check whoami /priv, service permissions, unquoted service paths, scheduled tasks, AlwaysInstallElevated, and stored credentials.

Evidence standards: timestamped command logs, raw tool output, screenshots showing target hostname/IP, and hashes of captured files; evidence must let a third party reproduce the finding.

Severity rating must combine technical impact with business context (data sensitivity, exposure, compensating controls); a CVSS base score alone is not a risk rating.

Cleanup obligation: remove uploaded tools, test accounts, webshells, scheduled tasks, and revert configuration changes; document every artifact created and its removal.

Retest criteria: a finding is closed only when the same exploit path is re-run and fails, not when the client states a patch was applied.

Report structure: executive summary (business risk, no jargon), scope and methodology, findings by severity, technical evidence per finding, and prioritized remediation roadmap.

Each finding needs: title, affected asset, severity with justification, reproduction steps, evidence, business impact, and a specific remediation with a verification method.

CVSS v3.1 base score components: Attack Vector, Attack Complexity, Privileges Required, User Interaction, Scope, plus Impact to Confidentiality, Integrity, Availability.

CVSS temporal and environmental metrics adjust for exploit maturity, remediation level, and client-specific asset criticality; base score alone understates or overstates real risk.

Advisory tone: describe what an attacker could achieve and what data or process is at risk; avoid blame language and avoid unverifiable claims of certainty.

Remediation guidance should name the control (patch level, configuration setting, network rule, code change) and the compensating control available if full fix is delayed.

Deliverable handling: encrypt reports containing exploit details, restrict distribution to named stakeholders, and define a retention and destruction schedule.

Debrief meeting agenda: restate objectives, walk through top three risks, agree remediation owners and dates, and confirm the retest window.

Metrics that support advisory value: findings by severity and category, mean time to remediate, percentage of prior findings closed, and coverage of the tested attack surface.