CSPT cheat sheet

Written authorization from an officer with authority must precede active testing; verbal approval does not create legal coverage.

An SOW defines deliverables, timeline, fees, assumptions, and acceptance criteria; the RoE defines permitted techniques and constraints.

Engagement models: black-box (no internal knowledge), grey-box (partial knowledge or credentials), white-box (full source, configuration, and credentials).

Confidentiality terms specify handling of client data, PII, credentials, and findings; NDAs bind testers and subcontractors.

Emergency escalation contacts and stop conditions must be reachable for the full test window.

Scope changes require written change control approved by both parties before testing new assets.

Deliverables typically include executive summary, technical findings, evidence, risk ratings, and remediation guidance.

Liability, indemnification, and insurance requirements are negotiated in the contract, not the technical RoE.

Scope enumerates assets by CIDR, hostname, URL, cloud account, API, mobile app, physical site, or personnel.

Out-of-scope must list third-party SaaS, shared hosting, partner networks, production data, and excluded techniques.

RoE specifies allowed and forbidden techniques: DoS, social engineering, physical entry, data exfiltration, brute force, and destructive tests.

Testing windows include time zone, blackout periods, and maximum request rates.

Source IPs and VPN endpoints are allowlisted and documented; spoofed or rotating IPs may violate scope.

Emergency stop procedure names the contact, channel, and expected response time.

Data handling rules cover encryption, storage location, retention period, destruction method, and breach notification.

Legal references include the authorization letter, applicable CFAA or Computer Misuse Act, GDPR or DPA, and contractual limits.

Passive recon uses public sources without directly touching the target: WHOIS, DNS records, CT logs, ASN and BGP data, search engines, and breach data.

Active recon sends packets to the target: port scans, service probes, web crawling, and banner grabs; it must be in scope.

DNS record types to enumerate: A, AAAA, CNAME, MX, NS, SOA, TXT, SRV, and PTR.

Zone transfer attempt: dig AXFR @nameserver domain; success reveals all zone records if the server is misconfigured.

Certificate Transparency logs reveal subdomains via crt.sh and Censys; search by domain and organization.

ASN lookup maps IP ranges to organizations; use whois, BGP.he.net, or RDAP to find netblocks.

Search dorks: site:, filetype:, inurl:, intitle:, and intext:; combine them to find exposed files and admin pages.

Email format discovery supports password spraying and phishing scope; verify the format from public sources.

CVSS v3.1 base score uses AV, AC, PR, UI, S, C, I, and A; base score excludes temporal and environmental metrics.

CVSS vector example: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Authenticated scans use credentials and report host-level patch state; unauthenticated scans infer from network exposure.

Banner and version checks can mislead when vendors backport patches without changing version strings.

Validate findings by reproducing the issue with minimal impact, capturing request and response, and confirming the affected component.

Common false positives: TLS cipher claims, missing headers, ICMP responses, and version-only matches; manual verification is required.

CWE classifies weakness type; CVE identifies a specific vulnerability; CVSS scores severity, not business risk.

Risk equals likelihood times impact adjusted for asset criticality, exposure, and compensating controls.

SSH local forward: ssh -L localport:target:targetport user@pivot binds a local listener through the pivot.

SSH remote forward: ssh -R remoteport:target:targetport user@pivot exposes the target to the remote side.

SSH dynamic forward: ssh -D 1080 user@pivot creates a SOCKS proxy; proxychains routes tools through it.

Meterpreter route add target/netmask session_id and autoroute enable pivoting at the network layer.

Chisel and Ligolo-ng create TCP or UDP tunnels over HTTP or WebSocket; useful when SSH is blocked.

Pass-the-Hash uses an NTLM hash directly with tools such as Impacket or Mimikatz; no plaintext password is required.

Lateral movement protocols: SMB (445), WinRM (5985/5986), RDP (3389), WMI (135), and SSH (22).

Egress filtering may block reverse shells; DNS, ICMP, and HTTPS are common allowed channels.

SQLi types: error-based, union-based, boolean blind, time-based blind, and out-of-band; test with quote and comment sequences.

XSS types: reflected, stored, and DOM-based; impact depends on session cookies, CSRF tokens, and CSP.

SSRF targets internal services and cloud metadata; the AWS IMDSv1 endpoint is 169.254.169.254/latest/meta-data/.

IDOR occurs when object identifiers are user-controlled; test by swapping IDs between two authenticated accounts.

File upload bypass: content-type, extension blacklists, magic bytes, path traversal, and server-side execution checks.

XXE requires an XML parser with external entities enabled; test with file://, http://, and parameter entities.

JWT flaws: alg:none, weak HMAC secret, kid injection, and missing signature verification.

Access control tests must use at least two roles; compare vertical and horizontal privilege differences.

Kerberoasting requests service tickets for accounts with SPNs and cracks them offline; no elevated rights are needed.

AS-REP roasting targets accounts with Do not require Kerberos preauthentication and returns crackable AS-REP responses.

DCSync requires DS-Replication-Get-Changes and Get-Changes-All rights on the domain object; it mimics domain controller replication.

BloodHound ingests SharpHound data to map ACL edges: GenericAll, WriteDACL, ForceChangePassword, and AddMember.

Unconstrained delegation stores TGTs of connecting users; constrained delegation limits use to specified services.

Resource-Based Constrained Delegation abuses msDS-AllowedToActOnBehalfOfOtherIdentity on a target computer.

Golden Ticket forges a TGT with the krbtgt hash; Silver Ticket forges a service ticket with a service account hash.

Entra ID attacks: consent phishing, device code phishing, token theft, and service principal credential abuse.

Windows privilege check: whoami /priv, whoami /groups, systeminfo, and accesschk for service and ACL permissions.

SeImpersonatePrivilege enables token impersonation; Potato-family exploits target Windows service accounts.

Unquoted service paths containing spaces allow binary planting in writable directories earlier in the path.

AlwaysInstallElevated in HKLM and HKCU allows MSI installation with SYSTEM privileges when both keys are set to 1.

Linux enumeration: sudo -l, find / -perm -4000, getcap -r /, cron jobs, and writable PATH directories.

A SUID binary with a known GTFOBins entry can spawn a root shell or read and write files as the owner.

Kernel exploits require matching kernel version and distribution; verify build and patch level before use.

Credential hunting locations: .bash_history, config files, /etc/shadow if readable, Windows registry, SAM, and LSASS.

Report structure: cover, confidentiality, scope, methodology, executive summary, findings, remediation, and appendices.

Each finding includes title, severity, affected assets, description, reproduction steps, evidence, impact, and remediation.

Severity ratings use CVSS plus business context; critical findings require immediate client notification.

Reproduction steps must be specific enough for a third party to verify without tester assistance.

Executive summary states overall risk posture in business language and avoids exploit-level jargon.

Evidence references link findings to screenshots, request and response pairs, and log excerpts.

Retest section documents remediation verification and residual risk.

Report classification and distribution list are agreed in the engagement contract.

Chain of custody records who collected, handled, transferred, and stored evidence; each transfer is signed and timed.

Hash evidence with SHA-256 at collection and verify before analysis; record hash values in the report.

Work on copies; preserve original media and capture volatile data first, including memory, connections, and processes.

Evidence storage is encrypted, access-controlled, and logged; retention period follows contract and law.

Screenshots include timestamp, URL or host, user context, and visible proof of impact.

Remediation guidance is specific, prioritized by risk, and includes validation criteria.

Retest verifies fixes and documents residual or accepted risk.

Destroy or return evidence per agreement; record destruction date and method.