CREST CPSA cheat sheet

Scope creep is any testing activity outside the signed rules of engagement (RoE); it must be re-authorised in writing before execution.

A penetration test report structure: executive summary, scope and methodology, findings (with CVSS), evidence, remediation, appendices.

CVSS v3.1 base score = f(Attack Vector, Attack Complexity, Privileges Required, User Interaction, Scope, Confidentiality, Integrity, Availability); temporal and environmental scores modify the base.

Risk rating = likelihood × impact; a finding with no proof-of-concept should be rated lower than one with a reproducible exploit.

Rules of engagement must define: target IP ranges/domains, testing window, permitted techniques (e.g., no DoS), emergency contact, data handling.

A retest verifies remediation; the retest scope should mirror the original finding's affected assets and test steps.

Chain of custody for evidence: hash (SHA-256) each artefact at collection, store in a write-once location, record collector and timestamp.

Debrief with the client should occur before the final report is issued to confirm factual accuracy and agree on disclosure timeline.

TCP three-way handshake: SYN → SYN/ACK → ACK; a half-open scan sends SYN and never completes the handshake.

Common ports: 22 SSH, 23 Telnet, 25 SMTP, 53 DNS, 80 HTTP, 443 HTTPS, 445 SMB, 3306 MySQL, 3389 RDP, 5432 PostgreSQL.

CIDR: /24 = 256 addresses, /16 = 65,536, /8 = 16,777,216; usable hosts = 2^(32−prefix) − 2.

Linux file permission 755 = owner rwx, group r-x, others r-x; setuid bit (4xxx) makes a binary run as its owner.

Base64 encodes 3 bytes to 4 characters; it is encoding, not encryption, and provides no confidentiality.

HTTP status classes: 1xx informational, 2xx success, 3xx redirection, 4xx client error, 5xx server error.

A reverse shell connects from the target back to the attacker; a bind shell listens on the target and the attacker connects in.

Hashing (SHA-256) provides integrity, not confidentiality; symmetric encryption (AES) uses one key, asymmetric (RSA) uses a key pair.

Passive reconnaissance never sends traffic to the target; active reconnaissance does and requires authorisation.

WHOIS returns registrar, registrant (often redacted under GDPR), creation and expiry dates, and name servers.

DNS record types: A (IPv4), AAAA (IPv6), MX (mail), NS (name server), TXT (SPF/DKIM/verification), CNAME (alias), SOA (zone authority).

Certificate Transparency logs (crt.sh) enumerate subdomains from issued TLS certificates without touching the target.

Google dorks: site:, inurl:, filetype:, intitle:, ext: - combine to find exposed documents or admin panels.

The Wayback Machine and common crawl archives reveal historical pages and removed content.

Shodan and Censys index internet-facing services by banner; search filters include port:, org:, product:, country:.

SPF (TXT v=spf1) lists authorised sending IPs; DMARC (TXT _dmarc) policy p=none|quarantine|reject; DKIM uses a public key in DNS.

A switch forwards by MAC address (layer 2); a router forwards by IP address (layer 3); a firewall filters by ACL (layers 3–4, or 7 for NGFW).

VLANs segment broadcast domains; inter-VLAN routing requires a layer-3 device or router-on-a-stick.

802.1Q trunking tags frames with a 12-bit VLAN ID (1–4094); the native VLAN is untagged.

Spanning Tree Protocol (802.1D) prevents layer-2 loops; root bridge election uses the lowest bridge ID (priority + MAC).

Common default credentials on network gear (admin/admin, cisco/cisco) are a frequent finding; check management interfaces on 80/443/22/23.

SNMPv1/v2c use plaintext community strings (default 'public'/'private'); SNMPv3 adds authentication and encryption.

A firewall rule is evaluated top-down; the first match wins, so a permissive rule above a deny rule overrides it.

Network address translation (NAT) hides internal IPs; PAT overloads one public IP across many internal sessions using port numbers.

Windows password hashes: LM (disabled by default since Vista), NTLM (MD4 of UTF-16 password), and cached domain credentials in the SECURITY hive.

SAM database stores local account hashes at %SystemRoot%\System32\config\SAM; it is locked while the OS runs and must be copied via VSS or offline.

Sysinternals tools for assessment: PsExec (remote exec), PsInfo, AccessChk (permissions), Autoruns (persistence).

Unquoted service paths with spaces allow binary planting if a writable directory precedes the executable name.

AlwaysInstallElevated (both HKLM and HKCU policy set to 1) lets any user install MSI packages with SYSTEM privileges.

Windows event IDs: 4624 logon, 4625 failed logon, 4672 special privileges assigned, 4688 process creation (if auditing enabled).

SMB signing disabled enables relay attacks; SMBv1 is deprecated and should be disabled.

Local admin group membership and UAC settings (EnableLUA, ConsentPromptBehaviorAdmin) determine privilege-escalation paths.

SUID/SGID binaries run with the file owner's/group's privileges; enumerate with find / -perm -4000 -type f 2>/dev/null.

Sudo rights are defined in /etc/sudoers; 'sudo -l' lists permitted commands; NOPASSWD entries are high-value.

Cron jobs in /etc/crontab, /etc/cron.*, and user crontabs run as the owning user; writable scripts executed by root are escalation paths.

/etc/passwd is world-readable (contains UID, shell); /etc/shadow is root-only and holds password hashes.

World-writable files and directories: find / -perm -0002 -type f; writable PATH entries allow command hijacking.

SSH configuration in /etc/ssh/sshd_config: PermitRootLogin, PasswordAuthentication, and authorized_keys files control access.

Capabilities (getcap -r /) grant subsets of root power, e.g., cap_setuid on a binary allows UID changes.

Kernel and service versions map to local privilege-escalation exploits; uname -a and package versions are key enumeration data.

OWASP Top 10 categories include Broken Access Control, Cryptographic Failures, Injection, Insecure Design, Security Misconfiguration, and SSRF.

The testing workflow: scoping → information gathering → configuration/deployment testing → authentication testing → authorisation testing → input validation → business logic → reporting.

Authentication testing covers weak password policy, credential enumeration, session fixation, and lack of lockout.

Authorisation testing distinguishes horizontal (same role, other user's data) from vertical (lower role reaching higher-role function) privilege escalation.

Session tokens must be tested for entropy, HttpOnly/Secure flags, SameSite attribute, and rotation on login.

Business-logic flaws (e.g., negative quantity, price tampering, step skipping) are not detected by scanners and require manual testing.

Testing must respect the RoE: rate limits, excluded paths (e.g., payment gateways), and data-handling constraints.

SQL injection payloads: ' OR '1'='1, UNION SELECT, and time-based (SLEEP(5), WAITFOR DELAY) confirm injection when error/boolean blind fails.

Cross-site scripting types: reflected (payload in response), stored (persisted), DOM-based (client-side sink such as innerHTML).

XSS defence: output encoding by context, Content-Security-Policy, and HttpOnly cookies.

CSRF requires a state-changing request without unpredictable token; SameSite cookies and anti-CSRF tokens mitigate.

Local file inclusion (LFI) uses path traversal (../../etc/passwd); remote file inclusion (RFI) requires allow_url_include and loads remote code.

Command injection separators: ; | & && || and backticks; test with sleep/ping to confirm blind execution.

SSRF tricks: 127.0.0.1, 169.254.169.254 (cloud metadata), and DNS rebinding to reach internal services.

Insecure direct object reference (IDOR) tests whether changing an identifier (e.g., ?id=123) returns another user's object.

SQL injection is mitigated by parameterised queries/prepared statements, not by input blacklists.

UNION-based injection requires matching column count and compatible data types; ORDER BY n is used to find the column count.

Information_schema (MySQL/SQL Server) and pg_catalog (PostgreSQL) enumerate tables and columns; Oracle uses all_tables/all_tab_columns.

Default database ports: MySQL 3306, PostgreSQL 5432, MSSQL 1433, Oracle 1521, MongoDB 27017, Redis 6379.

MongoDB and Redis historically shipped with no authentication; exposed instances on 27017/6379 are common findings.

Database privileges: least privilege means application accounts should not have DROP, FILE, or xp_cmdshell rights.

Blind SQL injection: boolean-based infers data from true/false responses; time-based infers from response delays.

Out-of-band exfiltration uses DNS or HTTP channels (e.g., xp_dirtree, UTL_HTTP, LOAD_FILE) when in-band is blocked.