Penetration Testing: Finding Security Vulnerabilities

// Authorization letter must include:
- Scope (what to test)
- Duration
- Allowed techniques
- Contact information
- Liability protection

# Whois lookup
whois example.com

# DNS enumeration
nslookup example.com
dig example.com ANY

# Search engines
Google dorks: site:example.com filetype:pdf

# Shodan (IoT search)
shodan search example.com

# Port scanning
nmap -sS -sV -O example.com

# Service detection
nmap -sV -p- example.com

# Vulnerability scan
nmap --script vuln example.com

-- Test for SQL injection
' OR '1'='1
' UNION SELECT NULL,NULL,NULL--
' OR 1=1--

-- Automated tools
sqlmap -u "http://example.com/page?id=1"

// Test for XSS
<script>alert('XSS')</script>
<img src=x onerror=alert('XSS')>
<svg onload=alert('XSS')>

// Automated
xsstrike -u http://example.com/search?q=test

# Default credentials
admin:admin
admin:password
root:root

# Brute force (authorized only)
hydra -l admin -P wordlist.txt example.com http-post-form

# Session hijacking
# Check for weak tokens
# Test for session fixation

# Network mapping
nmap -sC -sV -oA output 192.168.1.0/24

# Vulnerability scanning
nessus scan example.com

# Exploit testing
metasploit framework (authorized testing only)

# Information gathering
- Maltego
- theHarvester
- Recon-ng

# Web testing
- Burp Suite
- OWASP ZAP
- sqlmap

# Network testing
- Nmap
- Wireshark
- Metasploit

# Penetration Test Report

## Executive Summary
- High-level findings
- Risk ratings
- Recommendations

## Technical Details
- Vulnerability description
- Proof of concept
- Impact analysis
- Remediation steps

## Appendices
- Tools used
- Scope
- Methodology