Pentest Methodology
Last updated
Last updated
The goal of this phase is to gather as much information as possible from the network and to establish an initial foothold by performing common initial attacks. You should be able to gather credential hashes (NTLM, NTLMv2), running services, and other important information.
You’ve managed to crack the hashes you’ve captured from the Early Game stage or at least save them to a file, now what? The goal of this phase is to be able to move laterally on the network to gather more information until you can move vertically to compromise the network.
In this phase, you will be doing mostly exploitation, lateral movement, and some enumeration. You should be able to perform pass-the-password/pass-the-hash attacks, perform domain enumeration and exploitation, perform web exploitation, establish persistence, and perform other domain/network attacks.
Once you’ve reached this phase, you have already compromised the domain by gaining access to a domain admin account or through exploitation. You should now have the ability to dump the domain database (ntds.dit) and gather all domain account credentials. In a Pentest engagement, if you were able to quickly compromise a domain, try to do it again and find other ways to compromise a domain or find other vulnerabilities that the network may have.
Make sure you remove any persistence you set on the network and exploits that you used. Make sure you leave the network in the same state as when you started so that you won’t leave any holes in the network that real attackers can use.
Once the pentest is done, it is time for report writing. Make sure you include evidence/screenshots of the exploit that you performed, and include any helpful details for the clients such as the details of the attacks, remediation, etc. When doing pentest, a good strategy is to keep detailed notes and start drafting your report right away, filling it in as you go so that when you are in the report writing stage, you’re now just polishing your report.