PTES: PTES Technical Guidelines

This section is designed to be the PTES technical guidelines that help define certain procedures to follow during a penetration test. Something to be aware of is that these are only baseline methods that have been used in the industry. They will need to be continuously updated and changed upon by the community as well as within your own standard. Guidelines are just that, something to drive you in a direction and help during certain scenarios, but not an all encompassing set of instructions on how to perform a penetration test. Think outside of the box.
Contents
1
Tools Required
1.1
Operating Systems
1.1.1
MacOS X
1.1.2
VMware Workstation
1.1.2.1
Linux
1.1.2.2
Windows XP/7
1.2
Radio Frequency Tools
1.2.1
Frequency Counter
1.2.2
Frequency Scanner
1.2.3
Spectrum Analyzer
1.2.4
802.11 USB adapter
1.2.5
External Antennas
1.2.6
USB GPS
1.3
Software
2
Intelligence Gathering
2.1
OSINT
2.1.1
Corporate
2.1.2
Physical
2.1.2.1
Locations
2.1.2.2
Shared/Individual
2.1.2.3
Owner
2.1.2.3.1
Land/tax records
2.1.3
Datacenter Locations
2.1.3.1
Time zones
2.1.3.2
Offsite gathering
2.1.3.3
Product/Services
2.1.3.4
Company Dates
2.1.3.5
Position identification
2.1.3.6
Organizational Chart
2.1.3.7
Corporate Communications
2.1.3.7.1
Marketing
2.1.3.7.2
Lawsuits
2.1.3.7.3
Transactions
2.1.3.8
Job openings
2.1.4
Relationships
2.1.4.1
Charity Affiliations
2.1.4.2
Network Providers
2.1.4.3
Business Partners
2.1.4.4
Competitors
2.2
Individuals
2.2.1
Social Networking Profile
2.2.2
Social Networking Websites
2.2.3
Cree.py
2.3
Internet Footprint
2.3.1
Email addresses
2.3.1.1
Maltego
2.3.1.2
TheHarvester
2.3.1.3
NetGlub
2.3.2
Usernames/Handles
2.3.3
Social Networks
2.3.3.1
Newsgroups
2.3.3.2
Mailing Lists
2.3.3.3
Chat Rooms
2.3.3.4
Forums Search
2.3.4
Personal Domain Names
2.3.5
Personal Activities
2.3.5.1
Audio
2.3.5.2
Video
2.3.6
Archived Information
2.3.7
Electronic Data
2.3.7.1
Document leakage
2.3.7.2
Metadata leakage
2.3.7.2.1
FOCA (Windows)
2.3.7.2.2
Foundstone SiteDigger (Windows)
2.3.7.2.3
Metagoofil (Linux/Windows)
2.3.7.2.4
Exif Reader (Windows)
2.3.7.2.5
ExifTool (Windows/ OS X)
2.3.7.2.6
Image Search
2.4
Covert gathering
2.4.1
On-location gathering
2.4.1.1
Adjacent Facilities
2.4.1.2
Physical security inspections
2.4.1.2.1
Security guards
2.4.1.2.2
Badge Usage
2.4.1.2.3
Locking devices
2.4.1.2.4
Intrusion detection systems (IDS)/Alarms
2.4.1.2.5
Security lighting
2.4.1.2.6
Surveillance /CCTV systems
2.4.1.2.7
Access control devices
2.4.1.2.8
Environmental Design
2.4.1.3
Employee Behavior
2.4.1.4
Dumpster diving
2.4.1.5
RF / Wireless Frequency scanning
2.4.2
Frequency Usage
2.4.3
Equipment Identification
2.4.3.1
Airmon-ng
2.4.3.2
Airodump-ng
2.4.3.3
Kismet-Newcore
2.4.3.4
inSSIDer
2.5
External Footprinting
2.5.1
Identifying IP Ranges
2.5.1.1
WHOIS lookup
2.5.1.2
BGP looking glasses
2.5.2
Active Reconnaissance
2.5.3
Passive Reconnaissance
2.5.4
Active Footprinting
2.5.4.1
Zone Transfers
2.5.4.1.1
Host
2.5.4.1.2
Dig
2.5.4.2
Reverse DNS
2.5.4.3
DNS Bruting
2.5.4.3.1
Fierce2 (Linux)
2.5.4.3.2
DNSEnum (Linux)
2.5.4.3.3
Dnsdict6 (Linux)
2.5.4.4
Port Scanning
2.5.4.4.1
Nmap (Windows/Linux)
2.5.4.5
SNMP Sweeps
2.5.4.5.1
SNMPEnum (Linux)
2.5.4.6
SMTP Bounce Back
2.5.4.7
Banner Grabbing
2.5.4.7.1
HTTP
2.6
Internal Footprinting
2.6.1
Active Footprinting
2.6.1.1
Ping Sweeps
2.6.1.1.1
Nmap (Windows/Linux)
2.6.1.1.2
Alive6 (Linux)
2.6.1.2
Port Scanning
2.6.1.2.1
Nmap (Windows/Linux)
2.6.1.3
SNMP Sweeps
2.6.1.3.1
SNMPEnum (Linux)
2.6.1.4
Metasploit
2.6.1.5
Zone Transfers
2.6.1.5.1
Host
2.6.1.5.2
Dig
2.6.1.6
SMTP Bounce Back
2.6.1.7
Reverse DNS
2.6.1.8
Banner Grabbing
2.6.1.8.1
HTTP
2.6.1.8.2
httprint
2.6.1.9
VoIP mapping
2.6.1.9.1
Extensions
2.6.1.9.2
Svwar
2.6.1.9.3
enumIAX
2.6.1.10
Passive Reconnaissance
2.6.1.10.1
Packet Sniffing
3
Vulnerability Analysis
3.1
Vulnerability Testing
3.1.1
Active
3.1.2
Automated Tools
3.1.2.1
Network/General Vulnerability Scanners
3.1.2.2
Open Vulnerability Assessment System (OpenVAS)  (Linux)
3.1.2.3
Nessus (Windows/Linux)
3.1.2.4
NeXpose
3.1.2.5
eEYE Retina
3.1.2.6
Qualys
3.1.2.7
Core IMPACT
3.1.2.7.1
Core IMPACT Web
3.1.2.7.2
Core IMPACT WiFi
3.1.2.7.3
Core IMPACT Client Side
3.1.2.7.4
Core Web
3.1.2.7.5
coreWEBcrawl
3.1.2.7.6
Core Onestep Web RPTs
3.1.2.7.7
Core WiFi
3.1.2.8
SAINT
3.1.2.8.1
SAINTscanner
3.1.2.8.2
SAINTexploit
3.1.2.8.3
SAINTwriter
3.1.3
Web Application Scanners
3.1.3.1
General Web Application Scanners
3.1.3.1.1
WebInspect (Windows)
3.1.3.1.2
IBM AppScan
3.1.3.1.3
Web Directory Listing/Bruteforcing
3.1.3.1.4
Webserver Version/Vulnerability Identification
3.1.3.2
NetSparker (Windows)
3.1.3.3
Specialized Vulnerability Scanners
3.1.3.3.1
Virtual Private Networking (VPN)
3.1.3.3.2
IPv6
3.1.3.3.3
War Dialing
3.1.4
Passive Testing
3.1.4.1
Automated Tools
3.1.4.1.1
Traffic Monitoring
3.1.4.2
Wireshark
3.1.4.3
Tcpdump
3.1.4.4
Metasploit Scanners
3.1.4.4.1
Metasploit Unleashed
3.2
Vulnerability Validation
3.2.1
Public Research
3.2.1.1
Common/default passwords
3.2.2
Establish target list
3.2.2.1
Mapping Versions
3.2.2.2
Identifying Patch Levels
3.2.2.3
Looking for Weak Web Applications
3.2.2.4
Identify Weak Ports and Services
3.2.2.5
Identify Lockout threshold
3.3
Attack Avenues
3.3.1
Creation of Attack Trees
3.3.2
Identify protection mechanisms
3.3.2.1
Network protections
3.3.2.1.1
"Simple" Packet Filters
3.3.2.1.2
Traffic shaping devices
3.3.2.1.3
Data Loss Prevention (DLP) systems
3.3.2.2
Host based protections
3.3.2.2.1
Stack/heap protections
3.3.2.2.2
Whitelisting
3.3.2.2.3
AV/Filtering/Behavioral Analysis
3.3.2.3
Application level protections
4
Exploitation
4.1
Precision strike
4.1.1
Countermeasure Bypass
4.1.1.1
AV
4.1.1.2
Human
4.1.1.3
HIPS
4.1.1.4
DEP
4.1.1.5
ASLR
4.1.1.6
VA + NX (Linux)
4.1.1.7
w^x (OpenBSD)
4.1.1.8
WAF
4.1.1.9
Stack Canaries
4.1.1.9.1
Microsoft Windows
4.1.1.9.2
Linux
4.1.1.9.3
MAC OS
4.2
Customized Exploitation
4.2.1
Fuzzing
4.2.2
Dumb Fuzzing
4.2.3
Intelligent Fuzzing
4.2.4
Sniffing
4.2.4.1
Wireshark
4.2.4.2
Tcpdump
4.2.5
Brute-Force
4.2.5.1
Brutus (Windows)
4.2.5.2
Web Brute (Windows)
4.2.5.3
THC-Hydra/XHydra
4.2.5.4
Medusa
4.2.5.5
Ncrack
4.2.6
Routing protocols
4.2.7
Cisco Discovery Protocol (CDP)
4.2.8
Hot Standby Router Protocol (HSRP)
4.2.9
Virtual Switch Redundancy Protocol (VSRP)
4.2.10
Dynamic Trunking Protocol (DTP)
4.2.11
Spanning Tree Protocol (STP)
4.2.12
Open Shortest Path First (OSPF)
4.2.13
RIP
4.2.14
VLAN Hopping
4.2.15
VLAN Trunking Protocol (VTP)
4.3
RF Access
4.3.1
Unencrypted Wireless LAN
4.3.1.1
Iwconfig (Linux)
4.3.1.2
Windows (XP/7)
4.3.2
Attacking the Access Point
4.3.2.1
Denial of Service (DoS)
4.3.3
Cracking Passwords
4.3.3.1
WPA-PSK/ WPA2-PSK
4.3.3.2
WPA/WPA2-Enterprise
4.3.4
Attacks
4.3.4.1
LEAP
4.3.4.1.1
Asleap
4.3.4.2
802.1X
4.3.4.2.1
Key Distribution Attack
4.3.4.2.2
RADIUS Impersonation Attack
4.3.4.3
PEAP
4.3.4.3.1
RADIUS Impersonation Attack
4.3.4.3.2
Authentication Attack
4.3.4.4
EAP-Fast
4.3.4.5
WEP/WPA/WPA2
4.3.4.6
Aircrack-ng
4.4
Attacking the User
4.4.1
Karmetasploit Attacks
4.4.2
DNS Reques