Search

Checklists, FTW

  1. Ensure Rules of Engagement (ROE) is signed by client
  2. Add IPs in scope to Scope tab
  3. Verify customer scope
  4. Send kickoff email
  5. Conduct vulnerability scanning with Nessus
  6. Identify emails/users/pass in breach databases (DeHashed, Leakpeek)
  7. Identify employees & email address format (hunter.io, clearbit)
  8. Identify client’s website(s) and search for any data useful to help attack
    1. job posting, system information, password policy
  9. Attempt to enumerate any accounts on portals, password reset functions, etc
    1. Outlook, Office 365, SharePoint
    2. VPN, login on a website
  10. Run web app scans, if necessary
  11. Conduct manual testing and exploitation on targets
  12. Validate scanning tool vulnerabilities
  13. Conduct password spraying guessing and brute force on login portals
  14. Escalate access from external to internal
  15. Validate previous year findings have been resolved
  16. Cleanup