2

I have been to various documents such as OSSTMM, NIST 800-115, PCI DSS pentesting document. But is there any place where I can find out baseline list for internal network penetration testing? For example, a list which has a common application list which I should be checking for penetration testing in Windows, Linux, Network devices etc.

  • I think that's what the whole "enumeration phase" is for ... – schroeder Aug 13 '18 at 10:44
  • You can have a look to owasp lists. – Trevor65 Aug 13 '18 at 11:51
  • @Trevor65 I asked for network penetration, not web application. – tech_enthusiast Aug 16 '18 at 2:27
1

If you are looking for inspiration for what to test for to make sure that your enumeration phase isn't missing something obvious, then I would look to the automated scanning tools as your baseline.

  • nmap scripts
  • metasploit scanning modules
  • OpenVAS/Nessus
  • etc.

If you miss something that is in those lists, then you certainly have a gap in your enumeration processes. But then you should be using those tools as part of your enumeration phase anyway.

  • In addition I'd say you're going to want to enumerate Active Directory (if applicable). If you're not concerned about PowerShell logging in your environment then PowerSploit can be incredibly beneficial. – DKNUCKLES Aug 13 '18 at 12:19
  • I am aware about the tools used for enumeration process. But I cannot possibly wait for the vulnerabilities to come up from these tools and then search the exploits. If I am aware about the common vulnerabilities specific to OS, then I can atleast have some of my homework ready before I start the penetration process. – tech_enthusiast Aug 16 '18 at 2:26
  • @tech_enthusiast but that does not appear to be what you asked for. I'm not saying to use the tools to search for the newest vulnerabilities, I'm saying to use the scanners in those tools as a baseline to know what to look at. A common application/services/location/port/etc. list. – schroeder Aug 16 '18 at 7:53
  • @schroeder I understand your point to check the scanner. But is there any general list containing which ports/services/applications etc. to check which I can use to prepare the baseline ? – tech_enthusiast Aug 17 '18 at 6:36
  • @tech_enthusiast If I knew of any, I would mention them. The problem with any published lists is that they might get stale, so I'm not sure that anyone would create them. – schroeder Aug 17 '18 at 7:15
2

Its in general up to the pentester, the context, and your abilities...you can check those links for hints:

  1. Network Penetration Testing Checklist
  2. Web Application Penetration Testing Checklist
  3. Pentest methodology

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.