WBP SI cheat sheet

Scope authorization is the gate: testing performed outside a signed scope of work and rules of engagement is unauthorized access regardless of intent.

Test types by knowledge level: black-box (zero prior knowledge), grey-box (partial credentials or architecture), white-box (full source, configs, and credentials).

Methodology order: scoping and rules of engagement, reconnaissance, enumeration, vulnerability analysis, verification, exploitation (if in scope), post-exploitation, cleanup, reporting.

A finding requires three elements: an affected asset, a reproducible observation, and a security impact statement tied to a control objective.

False positive = reported condition does not exist; false negative = real condition not reported. Both are measured against a defined test coverage baseline.

Severity ratings map impact and likelihood to a scale (for example CVSS base score bands 0.1-3.9 low, 4.0-6.9 medium, 7.0-8.9 high, 9.0-10.0 critical).

Destructive or availability-affecting tests (password spraying lockouts, denial-of-service, data modification) require explicit written approval and a rollback plan.

Chain of custody begins at collection: every artifact records collector identity, timestamp with timezone, source host, and hash at acquisition.

Testing windows and rate limits are constraints, not preferences; exceeding agreed throttling invalidates results and can breach contractual terms.

Asset inventory classes: hardware, virtual instances, containers, cloud-managed services, network devices, endpoints, and data stores; each needs an owner and a location.

Discovery techniques: ICMP sweep, TCP SYN/connect scan, ARP scan on local segments, DNS zone transfer and brute force, certificate transparency logs, cloud provider APIs, and authenticated agent telemetry.

Unmanaged or shadow IT is identified by reconciling scan results against the authoritative inventory; the delta in both directions is the finding.

Asset criticality should derive from data classification, business process dependency, and exposure (internet-facing versus internal-only).

IPv6 and non-standard ports defeat naive discovery; full-range scans and neighbor discovery are required for coverage claims.

CMDB accuracy metrics: percentage of discovered hosts present in inventory, percentage of inventory records resolving to a live host, and mean time to reconcile.

Cloud assets require per-account, per-region enumeration because resources are invisible to network scanning unless routable.

Ownership attribution requires an accountable business unit; an asset without an owner is a governance gap, not merely a technical one.

Benchmark-based review compares live configuration against a published baseline (for example CIS Benchmarks) and records each control as compliant, non-compliant, or not applicable.

Configuration drift is measured by comparing current state to the approved golden image or infrastructure-as-code definition, not to vendor defaults.

Authentication controls to verify: password policy length and complexity, account lockout threshold and duration, MFA enforcement, privileged account separation, and session timeout.

TLS review checks protocol versions, cipher suites, certificate validity and chain, key size, and whether deprecated protocols (SSLv3, TLS 1.0/1.1) remain enabled.

Least privilege is verified by enumerating group membership, sudo or role assignments, service account rights, and unused accounts with last-logon data.

Logging configuration is a hardening item: audit policy coverage, log retention, forwarding to a central collector, and time synchronization via NTP.

Patch posture is assessed by comparing installed versions to vendor advisories and recording exposure window (days between advisory and remediation).

Network device hardening includes disabling unused services, restricting management access to a management VLAN, and enforcing AAA with centralized logging.

A hardening finding states the setting, the observed value, the required value, the baseline reference, and the compensating control if any.

Scanner output is a hypothesis; verification requires either a safe proof-of-concept request or version and configuration confirmation on the host.

CVSS base score reflects intrinsic characteristics; temporal and environmental scores adjust for exploit maturity and local mitigations, so severity ranking uses the contextual score.

Authenticated (credentialed) scans find materially more issues than unauthenticated scans because they read patch levels and local configuration.

CVE identifies a specific vulnerability; CWE classifies the weakness type; CPE identifies the affected product and version.

Version-based detection produces false positives when backported patches are present; banner or file-version confirmation resolves the ambiguity.

Exploitability signals: public exploit availability, weaponization in known frameworks, EPSS probability, and presence on CISA KEV list.

Risk ranking formula in practice: prioritize by exposure (internet-facing), exploitability, asset criticality, and data sensitivity, not by CVSS alone.

Duplicate and chain handling: a single root cause may generate many scanner rows; consolidate into one finding with multiple affected assets.

False positive closure requires documented evidence (response diff, patched version string, compensating control) retained with the finding record.

OWASP Top 10 categories function as a coverage checklist, not a test plan; each category maps to concrete test cases and payload classes.

Authentication tests: credential enumeration via response differences, password reset token entropy and reuse, MFA bypass, session fixation, and logout invalidation.

Session management checks cookie attributes (Secure, HttpOnly, SameSite), token randomness, idle and absolute timeout, and rotation on privilege change.

Access control testing requires at least two accounts at different privilege levels; IDOR is confirmed by replaying a request with another user's identifier.

Injection classes to test: SQL, NoSQL, OS command, LDAP, template injection, and XSS (reflected, stored, DOM-based); confirmation uses benign markers, not destructive payloads.

CSRF requires a state-changing request lacking an unpredictable token or origin check; SameSite cookies mitigate but do not replace token validation.

File upload and path traversal tests target extension validation, content-type enforcement, storage location outside webroot, and canonicalization bypass.

Deserialization and SSRF findings are high impact: SSRF confirmation should use an out-of-band interaction server, never internal production targets.

API testing adds mass assignment, excessive data exposure, rate limiting absence, and broken object-level authorization to the web checklist.

Detection review maps each critical attack technique to a log source, a detection rule, and an alert path; a technique with no log source is a blind spot.

Required log sources typically include endpoint telemetry, authentication servers, DNS, proxy, firewall, EDR, cloud control-plane audit logs, and application logs.

Log integrity controls: centralized forwarding, write-once or WORM storage, access restriction, and hash or signature verification for retained logs.

Time synchronization is a prerequisite for correlation; unsynchronized clocks break event ordering and timeline reconstruction.

Detection coverage is measured by executing controlled technique simulations and recording whether an alert fired, with time-to-detect.

Alert quality metrics: true positive rate, false positive rate, mean time to triage, and percentage of alerts with documented disposition.

Retention must satisfy both investigative need and regulatory minimums; a common baseline is 90 days hot searchable and one year archived.

Absence of evidence is not evidence of absence: a clean log review supports a conclusion only when coverage of the relevant source is proven.

Purple-team validation pairs each detection rule with the exact telemetry it consumes and the ATT&CK technique identifier it addresses.

Evidence admissibility attributes: authenticity, integrity, completeness, and continuity; each is demonstrated through documented handling.

Hashing at acquisition (SHA-256) and re-hashing at analysis proves integrity; any hash mismatch must be explained in the report.

Order of volatility for collection: CPU registers and cache, memory, network state, running processes, disk, remote logs, archival media.

Chain-of-custody record fields: item identifier, description, source, collector, date and time, storage location, and every transfer with signatures.

Screenshots and tool output must include timestamp, target identifier, and the exact request or command to be reproducible.

Report structure: executive summary, scope and methodology, findings ranked by risk, technical detail with evidence references, and remediation guidance.

A finding write-up contains title, affected assets, description, reproduction steps, evidence reference, impact, severity with rationale, and remediation.

Redaction removes credentials, personal data, and client-confidential detail while preserving the technical proof needed to reproduce.

Retention and destruction of evidence follow the engagement agreement and legal hold obligations; destruction is documented.

Remediation lifecycle states: identified, assigned, in progress, fixed pending verification, verified closed, risk accepted, false positive.

Retest verification requires re-running the original reproduction steps plus a regression check for the same weakness class on related assets.

SLA tiers commonly scale with severity, for example critical 7-15 days, high 30 days, medium 90 days, low 180 days, adjusted by contract.

Risk acceptance requires a named accountable owner, documented rationale, compensating controls, and an expiry date for re-evaluation.

Mean time to remediate is computed from verified closure date minus finding date, not from the date a ticket was opened.

Compliance mapping ties each finding to control frameworks (ISO 27001 Annex A, NIST 800-53, PCI DSS requirements) to support audit evidence.

Exception and false-positive closure must be evidenced; an unverified closure claim is reopened rather than accepted.

Trend reporting tracks open findings by severity over time, recurrence rate, and percentage of findings closed within SLA.

A finding is closed only when evidence of the fix is attached and the retest result is recorded by the verifying party.