I have been to various documents such as OSSTMM, NIST 800-115, PCI DSS pentesting document. But is there any place where I can find out baseline list for internal network penetration testing? For example, a list which has a common application list which I should be checking for penetration testing in Windows, Linux, Network devices etc.

  • I think that's what the whole "enumeration phase" is for ...
    – schroeder
    Commented Aug 13, 2018 at 10:44
  • You can have a look to owasp lists.
    – Trevor65
    Commented Aug 13, 2018 at 11:51
  • @Trevor65 I asked for network penetration, not web application. Commented Aug 16, 2018 at 2:27

2 Answers 2


If you are looking for inspiration for what to test for to make sure that your enumeration phase isn't missing something obvious, then I would look to the automated scanning tools as your baseline.

  • nmap scripts
  • metasploit scanning modules
  • OpenVAS/Nessus
  • etc.

If you miss something that is in those lists, then you certainly have a gap in your enumeration processes. But then you should be using those tools as part of your enumeration phase anyway.

  • In addition I'd say you're going to want to enumerate Active Directory (if applicable). If you're not concerned about PowerShell logging in your environment then PowerSploit can be incredibly beneficial.
    Commented Aug 13, 2018 at 12:19
  • I am aware about the tools used for enumeration process. But I cannot possibly wait for the vulnerabilities to come up from these tools and then search the exploits. If I am aware about the common vulnerabilities specific to OS, then I can atleast have some of my homework ready before I start the penetration process. Commented Aug 16, 2018 at 2:26
  • @tech_enthusiast but that does not appear to be what you asked for. I'm not saying to use the tools to search for the newest vulnerabilities, I'm saying to use the scanners in those tools as a baseline to know what to look at. A common application/services/location/port/etc. list.
    – schroeder
    Commented Aug 16, 2018 at 7:53
  • @schroeder I understand your point to check the scanner. But is there any general list containing which ports/services/applications etc. to check which I can use to prepare the baseline ? Commented Aug 17, 2018 at 6:36
  • @tech_enthusiast If I knew of any, I would mention them. The problem with any published lists is that they might get stale, so I'm not sure that anyone would create them.
    – schroeder
    Commented Aug 17, 2018 at 7:15

Its in general up to the pentester, the context, and your abilities...you can check those links for hints:

  1. Network Penetration Testing Checklist
  2. Web Application Penetration Testing Checklist
  3. Pentest methodology

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .