Penetration Testing Basics Cheat Sheet
Introduces the penetration testing methodology, phases, common toolsets, and reporting practices used in authorized security assessments.
2 PagesBeginnerFeb 20, 2026
Standard Pentest Phases
The typical lifecycle of an authorized penetration test.
- 1. Pre-engagement- Define scope, rules of engagement, and get written authorization
- 2. Reconnaissance- Passive/active info gathering (OSINT, DNS, WHOIS)
- 3. Scanning & enumeration- Identify live hosts, open ports, services, and versions
- 4. Vulnerability analysis- Map discovered services to known CVEs and misconfigurations
- 5. Exploitation- Attempt to gain access using validated vulnerabilities
- 6. Post-exploitation- Privilege escalation, lateral movement, data access proof
- 7. Reporting- Document findings, risk ratings, evidence, and remediation steps
Basic Recon Commands
Common first steps to gather information about a target.
bash
# DNS lookupsdig ANY example.comwhois example.com# Subdomain enumerationsubfinder -d example.com# Quick host/port discoverynmap -sn 192.168.1.0/24 # Ping sweepnmap -sV -sC -p- target.com # Version + default scripts, all ports
Types of Penetration Tests
Different testing approaches based on information provided.
- Black box- Tester has no prior knowledge of the target environment
- White box- Tester has full knowledge (source code, architecture, credentials)
- Gray box- Tester has partial knowledge, simulating an insider or limited-access attacker
- External test- Targets internet-facing assets only
- Internal test- Simulates an attacker already inside the network
Common Toolset by Purpose
Widely used tools organized by pentest activity.
- Reconnaissance- theHarvester, Shodan, Maltego
- Scanning- Nmap, Masscan
- Vulnerability scanning- Nessus, OpenVAS
- Exploitation- Metasploit, sqlmap
- Web app testing- Burp Suite, OWASP ZAP
- Password attacks- Hydra, John the Ripper, Hashcat
Advanced OSINT & Passive Recon
Gathering intelligence without touching the target directly, beyond basic WHOIS/dig lookups.
bash
# Certificate transparency for subdomain discoverycurl -s "https://crt.sh/?q=%.example.com&output=json" | jq -r '.[].name_value' | sort -u# Google/Bing dorking via automationgoogler -n 25 'site:example.com filetype:pdf'# Employee/email harvestingtheHarvester -d example.com -b all -l 200# Metadata leakage in public documentsexiftool -r *.pdf | grep -i 'author\|creator\|software'# Cloud asset discovery (S3, Azure Blob, GCS)cloud_enum -k example -k exampleco# GitHub secrets/recontrufflehog github --org=exampleorg --only-verified
CVSS v3.1 Scoring for Findings
Deriving a consistent severity rating so reports withstand client and auditor scrutiny.
text
# Base metric vector example: unauthenticated RCE via deserializationAV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H -> Base Score 10.0 (Critical)# Metric meaningsAV (Attack Vector): N=Network L=Local A=Adjacent P=PhysicalAC (Attack Complexity): L=Low H=HighPR (Privileges Required): N=None L=Low H=HighUI (User Interaction): N=None R=RequiredS (Scope): U=Unchanged C=ChangedC/I/A (Confidentiality/Integrity/Availability impact): N/L/H# Rule of thumb bucket after scoring# 9.0-10.0 Critical | 7.0-8.9 High | 4.0-6.9 Medium | 0.1-3.9 Low
Post-Exploitation Privilege Escalation Vectors
Common escalation paths to check once initial low-privilege access is obtained.
- Linux: SUID/SGID binaries- find / -perm -4000 -type f 2>/dev/null, then cross-check against GTFOBins
- Linux: sudo misconfig- sudo -l to list allowed commands run as another user without a password
- Linux: kernel exploits- Fingerprint kernel version and check against linux-exploit-suggester
- Windows: service misconfig- Unquoted service paths, weak service DACLs (accesschk), and AlwaysInstallElevated
- Windows: token impersonation- Potato-family exploits (JuicyPotato, PrintSpoofer) against SeImpersonatePrivilege
- Credential harvesting- Cached creds, browser stores, config files, and LSASS memory (with EDR awareness)
- Scheduled tasks / cron- Writable scripts triggered by a higher-privileged account or root cron job
Active Directory Attack Path Basics
Mapping and abusing common AD misconfigurations during an internal engagement.
bash
# Collect AD data for graph-based attack path analysisbloodhound-python -u user -p 'Passw0rd!' -d corp.local -ns 10.0.0.5 -c All# Kerberoasting: request service tickets for accounts with SPNsGetUserSPNs.py corp.local/user:'Passw0rd!' -dc-ip 10.0.0.5 -request# Crack the extracted TGS hashes offlinehashcat -m 13100 spns.txt rockyou.txt# AS-REP roasting: accounts with Kerberos pre-auth disabledGetNPUsers.py corp.local/ -usersfile users.txt -no-pass -dc-ip 10.0.0.5# Pass-the-hash lateral movementimpacket-psexec -hashes :NTLMHASH corp.local/[email protected]
Elements of a Defensible Pentest Report
What separates a professional deliverable from a raw tool dump.
- Executive summary- Business-risk framed narrative for non-technical stakeholders
- Scope & methodology- Exact IP ranges/apps tested, dates, and standards followed (PTES, OWASP, NIST)
- Findings with evidence- Screenshots, request/response pairs, and reproduction steps per finding
- CVSS + business risk rating- Technical severity plus contextual impact on the specific organization
- Remediation guidance- Actionable, prioritized fixes — not just 'patch the system'
- Attestation letter- Signed statement of work performed, useful for compliance audiences (PCI, SOC 2)
Pro Tip
Always get scope and authorization in writing before touching a target — even scanning systems you don't own without permission can violate laws like the CFAA, regardless of intent.
Was this cheat sheet helpful?
Explore Topics
#PenetrationTestingBasics#PenetrationTestingBasicsCheatSheet#Cybersecurity#Beginner#StandardPentestPhases#BasicReconCommands#TypesOfPenetrationTests#CommonToolsetByPurpose#Security#Testing#CheatSheet#SkillVeris
