3

I have been asked to create a Standard Operating Procedure (SOP), to describe the phases of: intelligence gathering, target profiling, vulnerability identification, target exploitation and post exploitation

I know what a standard operating procedure is but have no idea on how to create one.

Any chance you can help me to create one for these phases only?

Note: I am not asking you to do it for me instead I am asking for a tutorial or a guide you may know of or have come across which I can use to do it myself for these phases...thank you

  • 1
    Here is the NASA SOP for pentesting. That'll give you a guideline of how you should approach yours. – n8te Nov 12 '16 at 21:47
  • 2
    I sometimes wonder whether such standard procedures shouldn't be "best practices" guides for network admins, that one should much rather check in cooperation with those admins, and use non-standardized (read: admins don't "optimize" for these) methods for pen-testing. Everything else feels like "teaching kids to perform well in exams" rather than "learning for life". – Marcus Müller Apr 12 '17 at 17:50
1

Special Publication 800-115 Technical Guide to Information Security Testing and Assessment will help you in creating an SOP for security testing.

  • thank you its very detailed for a newbie ....how would i describe the phases of: intelligence gathering, target profiling, vulnerability identification, target exploitation and post exploitation in a SOP? I thought a SOP gave you instructions on how to do it rather then what it is? – xirokx Nov 13 '16 at 15:25
1

Check out the Penetration Testing Execution Standard (PTES).

PTES defines penetration testing through 7 phases:

  1. Pre-engagement Interactions
  2. Intelligence Gathering
  3. Threat Modeling
  4. Vulnerability Analysis
  5. Exploitation
  6. Post Exploitation
  7. Reporting

This guide covers all 7 phases of the penetration testing process in great detail:

http://www.pentest-standard.org/index.php/PTES_Technical_Guidelines

0

You could try using the Open Source Security Testing Methodology Manual (OSSTMM) - http://www.isecom.org/research/osstmm.html

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.