I have been to various documents such as OSSTMM, NIST 800-115, PCI DSS pentesting document. But is there any place where I can find out baseline list for internal network penetration testing? For example, a list which has a common application list which I should be checking for penetration testing in Windows, Linux, Network devices etc.
asked Aug 12, 2018 at 11:54
-
I think that's what the whole "enumeration phase" is for ...– schroeder ♦Aug 13, 2018 at 10:44
-
You can have a look to owasp lists.– Trevor65Aug 13, 2018 at 11:51
-
@Trevor65 I asked for network penetration, not web application.– tech_enthusiastAug 16, 2018 at 2:27
Add a comment
|
2 Answers
If you are looking for inspiration for what to test for to make sure that your enumeration phase isn't missing something obvious, then I would look to the automated scanning tools as your baseline.
- nmap scripts
- metasploit scanning modules
- OpenVAS/Nessus
- etc.
If you miss something that is in those lists, then you certainly have a gap in your enumeration processes. But then you should be using those tools as part of your enumeration phase anyway.
answered Aug 13, 2018 at 10:50
-
In addition I'd say you're going to want to enumerate Active Directory (if applicable). If you're not concerned about PowerShell logging in your environment then PowerSploit can be incredibly beneficial. Aug 13, 2018 at 12:19
-
I am aware about the tools used for enumeration process. But I cannot possibly wait for the vulnerabilities to come up from these tools and then search the exploits. If I am aware about the common vulnerabilities specific to OS, then I can atleast have some of my homework ready before I start the penetration process. Aug 16, 2018 at 2:26
-
@tech_enthusiast but that does not appear to be what you asked for. I'm not saying to use the tools to search for the newest vulnerabilities, I'm saying to use the scanners in those tools as a baseline to know what to look at. A common application/services/location/port/etc. list.– schroeder ♦Aug 16, 2018 at 7:53
-
@schroeder I understand your point to check the scanner. But is there any general list containing which ports/services/applications etc. to check which I can use to prepare the baseline ? Aug 17, 2018 at 6:36
-
@tech_enthusiast If I knew of any, I would mention them. The problem with any published lists is that they might get stale, so I'm not sure that anyone would create them.– schroeder ♦Aug 17, 2018 at 7:15
Its in general up to the pentester, the context, and your abilities...you can check those links for hints:
