LPF LPQ cheat sheet

CIA triad: Confidentiality (authorized disclosure only), Integrity (unauthorized modification prevented), Availability (timely, reliable access); a control is mapped to the property it protects.

Risk = Likelihood × Impact; qualitative scales (e.g., 1–5) map to a risk matrix, while quantitative analysis uses SLE = Asset Value × Exposure Factor and ALE = SLE × Annualized Rate of Occurrence.

Defense in depth layers preventive, detective, and corrective controls; a single control failure should not expose the asset, so compensating controls cover known gaps.

ISO/IEC 27001 defines an ISMS built on risk assessment and a Statement of Applicability; ISO/IEC 27002 supplies implementation guidance for Annex A control themes (organizational, people, physical, technological).

NIST Cybersecurity Framework 2.0 functions: Govern, Identify, Protect, Detect, Respond, Recover; CSF is voluntary guidance, not a certifiable standard.

Least privilege, separation of duties, and need-to-know limit blast radius; role-based access control assigns permissions to roles, not individuals.

Asset classification drives handling rules; typical tiers are public, internal, confidential, and restricted, with labeling, retention, and destruction requirements per tier.

Business continuity uses RTO (maximum tolerable downtime) and RPO (maximum tolerable data loss); a BIA derives both before recovery strategies are chosen.

Policy hierarchy: policy (intent, mandatory) → standard (specific requirements) → procedure (steps) → guideline (recommended practice); penetration testing scope should trace to an approved policy.

Passive (OSINT) collection touches no target systems: WHOIS/RDAP, DNS history, certificate transparency logs (crt.sh), ASN and netblock lookups, search engines, job postings, and breach data.

Active collection sends traffic to the target: DNS zone transfer attempts (AXFR), DNS brute force, port scans, and banner grabs; these are logged and must be inside authorized scope.

DNS record types to enumerate: A/AAAA (hosts), MX (mail), NS (authoritative servers), TXT (SPF/DKIM/DMARC, verification tokens), CNAME (aliases, third-party SaaS), SOA (zone metadata).

Subdomain discovery combines passive sources (CT logs, VirusTotal, SecurityTrails) with active resolution; wildcard DNS answers must be filtered or brute force yields false positives.

Certificate transparency logs record every publicly trusted TLS certificate, exposing internal hostnames, staging environments, and historical subdomains.

Search operators narrow OSINT: site:, filetype:, inurl:, intitle:, and cached/archive views reveal documents and legacy pages removed from the live site.

Shodan/Censys/FOFA index exposed services by banner; queries by org, ASN, product, or TLS certificate fingerprint map an external attack surface without scanning.

Google dorking and GitHub/GitLab search surface leaked credentials, API keys, internal wikis, and .env files; secrets found must be reported, not used beyond scope.

Recon output feeds the attack surface inventory: IP ranges, hostnames, technologies (via Wappalyzer/headers), email formats, and third-party providers that may need separate authorization.

TCP connect scan (-sT) completes the handshake and is logged by the target; SYN scan (-sS) sends SYN and never completes, requiring raw sockets/root and is stealthier.

Nmap host discovery: -sn (ping sweep, no port scan), -Pn (skip discovery, treat host as up), -sU (UDP), -sV (version detection), -O (OS fingerprint), -p- (all 65,535 TCP ports).

Port states: open (service listening), closed (RST returned), filtered (no response or ICMP unreachable - firewall dropping).

SMB enumeration with enum4linux-ng or smbclient -L lists shares, users, and OS info; null sessions and guest access are common misconfigurations.

SNMP community strings default to public/private; snmpwalk with a valid string dumps interfaces, processes, and sometimes credentials.

LLMNR/NBT-NS poisoning (Responder) captures NetNTLMv2 hashes from broadcast name resolution; relay them with ntlmrelayx when SMB signing is disabled.

VLAN hopping via double-tagged 802.1Q frames or DTP spoofing; mitigation is disabling unused ports, native VLAN separation, and disabling DTP/auto-trunking.

ARP spoofing enables MITM on a local segment; dynamic ARP inspection and port security are the countermeasures.

Segmentation testing verifies whether a foothold in one zone reaches management planes (hypervisor, iDRAC/iLO, backup) that should be isolated.

OWASP Top 10 (2021) categories: A01 Broken Access Control, A02 Cryptographic Failures, A03 Injection, A04 Insecure Design, A05 Security Misconfiguration, A06 Vulnerable Components, A07 Identification/Authentication Failures, A08 Software/Data Integrity Failures, A09 Logging/Monitoring Failures, A10 SSRF.

SQL injection classes: in-band (UNION, error-based), blind boolean, blind time-based, and out-of-band; test with quote characters, then confirm with boolean or time delays before extraction.

Cross-site scripting types: reflected (payload in request reflected in response), stored (persisted server-side), DOM-based (sink in client JS, e.g., innerHTML); context determines encoding (HTML, attribute, JS, URL).

Access control tests: IDOR (change object IDs), forced browsing (guess admin paths), horizontal vs vertical privilege escalation, and missing function-level checks on API endpoints.

SSRF: attacker-supplied URL fetched server-side; test 127.0.0.1, cloud metadata (169.254.169.254), and internal hostnames; mitigations are allowlists and blocking link-local ranges.

JWT testing: alg:none, algorithm confusion (RS256→HS256 with public key as secret), weak HMAC secrets cracked offline, and missing signature verification.

File upload bypasses: content-type spoofing, double extensions (.php.jpg), null bytes, .htaccess override, and archive extraction (zip slip).

Authentication flaws: username enumeration via response timing/messages, weak lockout, session fixation, predictable reset tokens, and MFA bypass via response manipulation.

Burp Suite workflow: scope and target config → proxy intercept → repeater for manual requests → intruder for fuzzing → scanner (Pro) for coverage; always verify scanner findings manually to exclude false positives.

802.11 security progression: WEP (RC4, broken IVs) → WPA (TKIP) → WPA2 (CCMP/AES, 4-way handshake, PMKID) → WPA3 (SAE, forward secrecy, protected management frames).

WPA2 handshake capture (airodump-ng) yields a 4-way handshake crackable offline with aircrack-ng or hashcat (-m 22000) if the passphrase is weak; PMKID attacks skip the handshake.

WPA3 SAE resists offline dictionary attacks; downgrade/transition-mode attacks and Dragonblood side channels are the residual risks.

WPS PIN (pixie-dust / brute force) recovers the WPA passphrase in minutes when WPS is enabled; disable WPS as mitigation.

Evil twin and rogue AP attacks clone an SSID to harvest credentials via a captive portal; KARMA attacks respond to any probe request.

Bluetooth: BlueBorne (stack vulnerabilities), Bluejacking (unsolicited messages), Bluesnarfing (data theft), and BLE sniffing of unencrypted GATT characteristics.

Android testing: adb shell, drozer for IPC/exported components, apktool for decompilation, Frida for runtime hooking; check exported activities, services, and content providers lacking permissions.

iOS testing: check Info.plist ATS settings, keychain accessibility classes, jailbreak detection, and binary protections (PIE, stack canaries, ARC); tools include objection and Frida.

Mobile OWASP MASVS categories: storage, crypto, auth, network, platform interaction, code quality, resilience; insecure data storage and cleartext traffic remain top findings.

Metasploit workflow: search → use → show options → set RHOSTS/LHOST/LPORT → check (if available) → exploit; payloads are staged (stager + stage) or stageless.

Meterpreter sessions run in memory; migrate to a stable process before running noisy post modules to survive process termination.

Reverse shells are preferred over bind shells because egress filtering usually permits outbound connections; common one-liners use bash, nc, or PowerShell.

Privilege escalation on Linux: SUID binaries (GTFOBins), sudo misconfigurations (sudo -l), cron jobs, writable service files, kernel exploits; on Windows: unquoted service paths, weak service permissions, AlwaysInstallElevated, token impersonation.

Credential dumping: Mimikatz (sekurlsa::logonpasswords, lsadump::sam), secretsdump.py, and LSASS access; Kerberoasting requests service tickets and cracks them offline.

Active Directory: BloodHound maps attack paths; Kerberoasting, AS-REP roasting, and DCSync are high-impact paths; Golden Ticket forges a TGT with the krbtgt hash.

Lateral movement uses PsExec, WMI, WinRM, SSH, and pass-the-hash; each leaves distinct logs (4624 logon type 3, service creation 7045).

Persistence mechanisms (scheduled tasks, registry Run keys, cron, systemd units) must be documented and removed during cleanup.

Exfiltration and pivoting (proxychains, SSH tunnels, Chisel) are used only when in scope; all actions must be timestamped for the report.

Phishing variants: mass phishing, spear phishing (targeted), whaling (executives), vishing (voice), smishing (SMS), and clone phishing (replica of a legitimate message).

Pretexting builds a believable scenario; authority, urgency, social proof, and reciprocity are the influence levers tested.

Credential-harvesting pages require authorization and a takedown plan; captured credentials must be handled as sensitive data and never reused outside scope.

Physical testing: tailgating, piggybacking, badge cloning (125 kHz HID vs 13.56 MHz MIFARE), lock bypass, and dumpster diving.

RFID/NFC cloning tools (Proxmark3, Flipper Zero) can duplicate low-frequency badges; high-frequency MIFARE Classic is vulnerable to key recovery, DESFire is not trivially cloneable.

Lock types: pin tumbler, wafer, and electronic; bypass via shimming, raking, or under-door tools - test only with written authorization and a safety plan.

OSINT for social engineering: org charts, email formats, conference bios, and social media reveal targets and reporting relationships.

Human-targeted tests require clear rules: no real harm, no coercion, defined escalation for staff who report, and a debrief with the target team.

Metrics for a social engineering campaign: click rate, credential submission rate, report rate, and time-to-report; these drive awareness training priorities.

Report structure: executive summary (business risk, no jargon), scope and methodology, findings with severity, evidence, remediation, and appendices.

CVSS v3.1 base score components: Attack Vector, Attack Complexity, Privileges Required, User Interaction, Scope, Confidentiality/Integrity/Availability Impact; base score 9.0–10.0 is Critical.

Severity should combine CVSS with business context (asset criticality, data sensitivity, exposure); a high CVSS on an isolated dev box may be Medium in practice.

Each finding needs: title, severity, affected asset/URL, description, reproduction steps, evidence (request/response, screenshot), business impact, and remediation guidance.

Remediation advice should be specific and actionable (e.g., parameterized queries, patch version) rather than generic ('fix input validation').

Retesting verifies fixes and is scoped separately; the report should state which findings were retested and their status (fixed, partially fixed, risk accepted).

Communication: brief the technical team during testing, deliver the executive summary to leadership, and agree on a disclosure timeline before publishing.

Data handling: encrypt reports at rest, use secure transfer, redact credentials and PII, and define retention/destruction per the engagement contract.

Lessons learned and metrics (findings by severity, mean time to remediate) feed the next engagement and the client's risk register.

Written authorization (rules of engagement + statement of work) is mandatory; it defines scope, time window, allowed techniques, and emergency contacts.

A 'get out of jail free' letter should be carried by testers and list the client contact and authorization reference for on-site work.

Common legal frameworks: CFAA (US), Computer Misuse Act (UK), GDPR (EU data protection); unauthorized access is a criminal offense regardless of intent.

PCI DSS requires penetration testing of the cardholder data environment at least annually and after significant changes; internal and external tests are separate requirements.

Scope exclusions must be explicit: third-party SaaS, production databases, and out-of-scope IP ranges; testing them without authorization is a legal breach.

Data protection: minimize collection, store findings securely, and delete client data at engagement close unless retention is contractually required.

Ethics: report all findings (including ones that embarrass the tester), do not exceed scope even if a vulnerability invites it, and stop if you encounter evidence of a real breach.

Responsible disclosure: notify the vendor, allow a reasonable remediation window (commonly 90 days), and coordinate publication.

Insurance and liability: professional indemnity and cyber liability coverage, plus a limitation-of-liability clause, are standard contract protections.

PTES phases: pre-engagement interactions, intelligence gathering, threat modeling, vulnerability analysis, exploitation, post-exploitation, reporting.

OSSTMM and NIST SP 800-115 describe technical assessment methods; MITRE ATT&CK maps observed techniques to adversary TTPs for the report.

Standard workflow: scoping → recon → enumeration → vulnerability analysis → exploitation → post-exploitation → cleanup → reporting → retest.

Tool categories: recon (nmap, amass, subfinder), web (Burp Suite, ffuf, sqlmap), exploitation (Metasploit, searchsploit), post-exploitation (BloodHound, Mimikatz), and reporting (Dradis, PlexTrac).

Kali Linux is the common distribution; tools should be run from a controlled VM with snapshots and a dedicated testing IP range.

Scope validation: confirm IPs/hostnames resolve to client-owned assets (WHOIS, reverse DNS) before scanning to avoid testing a third party.

Logging and evidence: timestamp every command, save raw tool output, and keep a chain-of-custody for any artifacts captured.

Cleanup: remove uploaded shells, created accounts, scheduled tasks, and test files; verify with the client before closing the engagement.

Quality control: manually validate scanner output, reproduce every finding, and peer-review the report before delivery.