PECB LPTP cheat sheet

Penetration testing is an authorized, goal-oriented simulation of adversary activity; it differs from a vulnerability assessment, which enumerates weaknesses without validating exploitability.

Core phases: scoping and pre-engagement, reconnaissance, threat modeling, exploitation, post-exploitation, reporting, and remediation retest.

Vulnerability + threat + impact = risk; a finding without a credible threat actor path is a weakness, not necessarily a risk.

Black-box, gray-box, and white-box describe the knowledge level given to testers, not the test's depth or quality.

Red team engagements measure detection and response effectiveness; penetration tests measure technical exposure of specific assets.

False positive: reported issue that cannot be reproduced. False negative: real issue missed; false negatives are the more damaging failure mode for assurance.

Rules of engagement must define authorized targets, excluded systems, test windows, escalation contacts, and stop conditions.

Testing without written authorization is unauthorized access regardless of intent; authorization scope defines the legal boundary.

Scoping inputs: business objectives, in-scope IP ranges/domains/applications, out-of-scope assets, testing type, duration, and budget.

A written statement of work plus signed authorization letter are the minimum contractual artifacts before any active testing begins.

Third-party-hosted assets require separate written permission from the hosting provider; the client's consent alone is insufficient.

Rules of engagement should specify prohibited techniques (e.g., DoS, social engineering, data exfiltration) and handling of sensitive data encountered.

Define escalation paths: who is contacted, how, and within what time, if a critical vulnerability or live compromise is discovered.

Test-window selection balances production risk: business-hours testing reduces outage risk; off-hours testing reduces detection by staff.

Engagement risks to plan for: production outage, data corruption, scope creep, tester error, and legal exposure from out-of-scope access.

A retest clause and remediation window should be agreed at scoping so the deliverable includes verified closure, not just findings.

Reconnaissance splits into passive (OSINT, certificate transparency, DNS records) and active (port scanning, service probing).

Port states: open (service listening), closed (reachable, no listener), filtered (no response or ICMP unreachable due to filtering).

TCP connect scan completes the handshake; SYN scan sends SYN and resets, leaving less logging but requiring raw socket privileges.

Nmap -sV identifies service versions; -O fingerprints the OS; -sC runs default NSE scripts.

Common web testing targets: OWASP Top 10 categories, authentication flaws, access control (IDOR), injection, and misconfiguration.

Privilege escalation splits into vertical (lower to higher privilege) and horizontal (same level, different user's data).

Post-exploitation goals: credential harvesting, lateral movement, persistence, and demonstrating business impact - always within agreed scope.

Evidence standard: capture timestamped screenshots, request/response pairs, and reproducible command sequences for each validated finding.

CVSS base score reflects intrinsic severity; environmental and temporal metrics adjust it for the client's context.

Report structure: executive summary, scope and methodology, findings with evidence, risk ratings, remediation guidance, and appendices.

Executive summary is business-oriented: overall risk posture, key themes, and prioritized actions - no raw command output.

Each finding should state title, affected asset, description, evidence, CVSS or risk rating, business impact, and specific remediation.

Risk rating must be justified; a critical rating without a plausible exploitation path undermines report credibility.

A findings review meeting (readout) lets the client validate context and challenge ratings before the final report is issued.

Report classification and distribution list should be agreed at scoping; reports often contain exploitable detail and sensitive data.

Remediation guidance should be actionable and prioritized by risk, with quick wins separated from structural fixes.

Retest reporting confirms which findings are closed, partially fixed, or still open, with evidence for each status.

A penetration testing program defines cadence (e.g., annual plus change-triggered), coverage across asset classes, and ownership of remediation.

Metrics that matter: findings by severity trend, mean time to remediate, retest pass rate, and percentage of critical assets tested.

Tester competency evidence includes certifications, references, sample reports, and scope-appropriate experience.

Engagement governance: named engagement manager, defined communication cadence, status reporting, and a documented issue escalation path.

Quality assurance reviews reports for accuracy, reproducibility, and consistent risk rating before delivery.

Knowledge management retains reports centrally so patterns across engagements inform risk decisions and future scoping.

Budget planning should cover testing, retesting, and remediation effort; testing without remediation budget produces recurring findings.

Leadership responsibilities include securing executive sponsorship, aligning testing to business risk, and enforcing remediation accountability.

Penetration testing is an authorized, goal-oriented simulation of adversary activity; it differs from a vulnerability assessment, which enumerates weaknesses without validating exploitability.

Core phases: scoping and pre-engagement, reconnaissance, threat modeling, exploitation, post-exploitation, reporting, and remediation retest.

Vulnerability + threat + impact = risk; a finding without a credible threat actor path is a weakness, not necessarily a risk.

Black-box, gray-box, and white-box describe the knowledge level given to testers, not the test's depth or quality.

Red team engagements measure detection and response effectiveness; penetration tests measure technical exposure of specific assets.

False positive: reported issue that cannot be reproduced. False negative: real issue missed; false negatives are the more damaging failure mode for assurance.

Rules of engagement must define authorized targets, excluded systems, test windows, escalation contacts, and stop conditions.

Testing without written authorization is unauthorized access regardless of intent; authorization scope defines the legal boundary.

Scoping inputs: business objectives, in-scope IP ranges/domains/applications, out-of-scope assets, testing type, duration, and budget.

A written statement of work plus signed authorization letter are the minimum contractual artifacts before any active testing begins.

Third-party-hosted assets require separate written permission from the hosting provider; the client's consent alone is insufficient.

Rules of engagement should specify prohibited techniques (e.g., DoS, social engineering, data exfiltration) and handling of sensitive data encountered.

Define escalation paths: who is contacted, how, and within what time, if a critical vulnerability or live compromise is discovered.

Test-window selection balances production risk: business-hours testing reduces outage risk; off-hours testing reduces detection by staff.

Engagement risks to plan for: production outage, data corruption, scope creep, tester error, and legal exposure from out-of-scope access.

A retest clause and remediation window should be agreed at scoping so the deliverable includes verified closure, not just findings.

Reconnaissance splits into passive (OSINT, certificate transparency, DNS records) and active (port scanning, service probing).

Port states: open (service listening), closed (reachable, no listener), filtered (no response or ICMP unreachable due to filtering).

TCP connect scan completes the handshake; SYN scan sends SYN and resets, leaving less logging but requiring raw socket privileges.

Nmap -sV identifies service versions; -O fingerprints the OS; -sC runs default NSE scripts.

Common web testing targets: OWASP Top 10 categories, authentication flaws, access control (IDOR), injection, and misconfiguration.

Privilege escalation splits into vertical (lower to higher privilege) and horizontal (same level, different user's data).

Post-exploitation goals: credential harvesting, lateral movement, persistence, and demonstrating business impact - always within agreed scope.

Evidence standard: capture timestamped screenshots, request/response pairs, and reproducible command sequences for each validated finding.

CVSS base score reflects intrinsic severity; environmental and temporal metrics adjust it for the client's context.

Report structure: executive summary, scope and methodology, findings with evidence, risk ratings, remediation guidance, and appendices.

Executive summary is business-oriented: overall risk posture, key themes, and prioritized actions - no raw command output.

Each finding should state title, affected asset, description, evidence, CVSS or risk rating, business impact, and specific remediation.

Risk rating must be justified; a critical rating without a plausible exploitation path undermines report credibility.

A findings review meeting (readout) lets the client validate context and challenge ratings before the final report is issued.

Report classification and distribution list should be agreed at scoping; reports often contain exploitable detail and sensitive data.

Remediation guidance should be actionable and prioritized by risk, with quick wins separated from structural fixes.

Retest reporting confirms which findings are closed, partially fixed, or still open, with evidence for each status.

A penetration testing program defines cadence (e.g., annual plus change-triggered), coverage across asset classes, and ownership of remediation.

Metrics that matter: findings by severity trend, mean time to remediate, retest pass rate, and percentage of critical assets tested.

Tester competency evidence includes certifications, references, sample reports, and scope-appropriate experience.

Engagement governance: named engagement manager, defined communication cadence, status reporting, and a documented issue escalation path.

Quality assurance reviews reports for accuracy, reproducibility, and consistent risk rating before delivery.

Knowledge management retains reports centrally so patterns across engagements inform risk decisions and future scoping.

Budget planning should cover testing, retesting, and remediation effort; testing without remediation budget produces recurring findings.

Leadership responsibilities include securing executive sponsorship, aligning testing to business risk, and enforcing remediation accountability.