4

I have been asked to create a Standard Operating Procedure (SOP), to describe the phases of: intelligence gathering, target profiling, vulnerability identification, target exploitation and post exploitation

I know what a standard operating procedure is but have no idea on how to create one.

Any chance you can help me to create one for these phases only?

Note: I am not asking you to do it for me instead I am asking for a tutorial or a guide you may know of or have come across which I can use to do it myself for these phases...thank you

Improve this question
2
  • 1
    Here is the NASA SOP for pentesting. That'll give you a guideline of how you should approach yours.
    – n8te
    Commented Nov 12, 2016 at 21:47
  • 2
    I sometimes wonder whether such standard procedures shouldn't be "best practices" guides for network admins, that one should much rather check in cooperation with those admins, and use non-standardized (read: admins don't "optimize" for these) methods for pen-testing. Everything else feels like "teaching kids to perform well in exams" rather than "learning for life".
    – Marcus Müller
    Commented Apr 12, 2017 at 17:50

3 Answers 3

Reset to default
1

Special Publication 800-115 Technical Guide to Information Security Testing and Assessment will help you in creating an SOP for security testing.

Improve this answer
1
  • thank you its very detailed for a newbie ....how would i describe the phases of: intelligence gathering, target profiling, vulnerability identification, target exploitation and post exploitation in a SOP? I thought a SOP gave you instructions on how to do it rather then what it is?
    – xirokx
    Commented Nov 13, 2016 at 15:25
1

Check out the Penetration Testing Execution Standard (PTES).

PTES defines penetration testing through 7 phases:

  1. Pre-engagement Interactions
  2. Intelligence Gathering
  3. Threat Modeling
  4. Vulnerability Analysis
  5. Exploitation
  6. Post Exploitation
  7. Reporting

This guide covers all 7 phases of the penetration testing process in great detail:

http://www.pentest-standard.org/index.php/PTES_Technical_Guidelines

Improve this answer
0

You could try using the Open Source Security Testing Methodology Manual (OSSTMM) - http://www.isecom.org/research/osstmm.html

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .