I have been to various documents such as OSSTMM, NIST 800-115, PCI DSS pentesting document. But is there any place where I can find out baseline list for internal network penetration testing? For example, a list which has a common application list which I should be checking for penetration testing in Windows, Linux, Network devices etc.
If you are looking for inspiration for what to test for to make sure that your enumeration phase isn't missing something obvious, then I would look to the automated scanning tools as your baseline.
- nmap scripts
- metasploit scanning modules
If you miss something that is in those lists, then you certainly have a gap in your enumeration processes. But then you should be using those tools as part of your enumeration phase anyway.