Methodology
Penetration testing methodology for the OSCP and other engagements.
Enumeration Checklist
Web
- Web Server Vulnerability
- Web Framework Vulnerability
- Default Credentials
- Guessed Credentials
- View Page Source
- View Cookies
- View Burp Request (redirects)
- LFI or RFI Vulnerabilities
- Directory Search (nikto, gobuster)
- Check for SQL Injection
FTP
- Software Vulnerability
- Default Credentials
- Guessed Credentials
- Anonymous Access
- Passive Mode Access
- Download Files
- Upload Files
- List all (hidden) files
- Binary and ascii transfer modes
Samba
- Software Vulnerability
- Anonymous Access
- Download Files
- Upload Files
DNS
- Hidden Domain Names
SQL
- Software Vulnerability
- Check if able to connect
- Default Credentials
- Guessed Credentials
- Software Vulnerability
- Username Enumeration
- Default Credentials
- Guessed Credentials
- Check mail inbox
- Log file poisoning