PenTest+ cheat sheet

Rules of engagement define authorized targets, testing windows, allowed techniques, escalation contacts, and stop conditions; anything outside scope is unauthorized.

Written authorization must be signed before testing; it identifies client, tester, dates, scope, and limitations and supports legal defensibility.

Black-box testing provides no internal knowledge; gray-box provides partial knowledge; white-box provides full source, configuration, and credentials.

Scope should list in-scope IP ranges, domains, and applications; out-of-scope systems; third-party-hosted services; and data-handling constraints.

Regulatory drivers include PCI DSS for cardholder data, HIPAA for protected health information, GDPR for EU personal data, and SOX for financial controls.

Risk rating commonly combines likelihood and impact; CVSS base score measures technical severity but not business context.

A statement of work defines deliverables, timeline, fees, and acceptance criteria; an NDA governs confidentiality of findings and client data.

Deconfliction and emergency contacts must be verified before execution; a kill-switch procedure stops testing if critical systems are affected.

Findings reports separate executive summary from technical detail and include evidence, affected assets, reproduction steps, and remediation guidance.

Passive reconnaissance never directly touches target-owned systems; examples include WHOIS, DNS records, certificate transparency logs, search engines, and third-party data.

Active reconnaissance sends traffic to target assets; examples include port scans, banner grabs, service probes, and web content discovery.

A DNS zone transfer (AXFR) succeeds only if the authoritative server allows it and can reveal all records for a zone.

Nmap host discovery (-sn) finds live hosts without port scanning; -sS is a SYN scan, -sT is a TCP connect scan, and -sU is a UDP scan.

Service and version detection uses -sV; OS fingerprinting uses -O; both increase scan time and generated traffic.

SNMP enumeration with default community strings can reveal system, interface, and routing data; SNMPv3 uses authentication and encryption.

SMB enumeration can reveal shares, users, groups, and OS versions; legacy null sessions expose this data when allowed.

Certificate transparency and subdomain enumeration reveal assets not linked from the main site; ownership must be verified before active testing.

Credentialed scans authenticate to hosts and generally produce fewer false positives and deeper patch and configuration data than unauthenticated scans.

CVSS base metrics include attack vector, attack complexity, privileges required, user interaction, scope, confidentiality, integrity, and availability.

CVE identifies a specific published vulnerability; CWE classifies the weakness type; NVD enriches CVE records with CVSS and references.

EPSS estimates the probability that a CVE will be exploited in the wild within the next 30 days; it is not a severity score.

A false positive is a reported issue that is not actually present; a false negative is a real issue the scanner missed.

SAST examines source or bytecode without executing it; DAST tests a running application from the outside.

Fuzzing sends malformed or unexpected input to discover crashes and input-validation flaws.

Vulnerability prioritization combines exploitability, exposure, business criticality, compensating controls, and available exploit code.

Validate findings with manual reproduction or a controlled proof of concept before reporting to avoid scanner-noise inflation.

MITRE ATT&CK catalogs adversary tactics and techniques; the Lockheed Martin kill chain describes phases from reconnaissance to actions on objectives.

Password spraying tries one common password across many accounts; credential stuffing reuses breached username and password pairs.

Pass-the-hash uses an NTLM hash to authenticate without cracking the plaintext password and works where NTLM authentication is permitted.

Kerberoasting requests service tickets for accounts with service principal names and cracks them offline using the service account password hash.

SQL injection occurs when untrusted input changes SQL query structure; parameterized queries prevent it.

XSS executes attacker script in a victim's browser; CSRF forces an authenticated browser to send an unintended request.

SSRF makes a server fetch an attacker-chosen URL; XXE abuses XML external entity processing to read files or make requests.

Reverse shells connect from victim to attacker; bind shells listen on the victim and require the attacker to connect inbound.

WPA2-PSK attacks capture the four-way handshake and attempt offline dictionary cracking; WPA3-SAE resists offline capture cracking.

Persistence mechanisms include scheduled tasks, services, startup items, cron jobs, registry Run keys, and web shells.

Credential dumping targets LSASS memory, the SAM database, NTDS.dit on domain controllers, and cached credentials.

DCSync impersonates domain controller replication to request password hashes from Active Directory without logging on to the domain controller.

A golden ticket forges a Kerberos TGT using the KRBTGT hash; a silver ticket forges a service ticket using a service account hash.

Lateral movement tools include PsExec, WMI, WinRM, SMB, SSH, RDP, and remote service creation.

Pivoting uses a compromised host to reach otherwise unreachable networks; port forwarding and SOCKS proxies tunnel traffic through it.

C2 beaconing is periodic outbound communication from an implant to a controller; jitter and common protocols help blend with normal traffic.

Data exfiltration can occur over DNS, HTTP/S, ICMP, or cloud storage; DLP and egress filtering are detective or preventive controls.

Cleanup removes created accounts, files, scheduled tasks, and tooling; evidence needed for reporting must be preserved before removal.