Pentest in a nutshell

A penetration test is easier to manage when it is divided into clear phases. Start by discovering systems and services, enumerate what is exposed, identify a possible access path, then perform local enumeration from the obtained account. Each new piece of information should determine the next step instead of running tools without a clear objective.

The first goal is to understand what is reachable. A network scan can identify hosts, open ports and the services exposed by each machine. Saving the output allows the results to be reviewed later and reused during deeper enumeration.

A full-port scan provides the attack surface. Once interesting ports have been identified, perform a second targeted scan with service detection and default Nmap scripts. This produces cleaner and more useful information than repeatedly scanning every port.

Do not treat an open port as the final result. Translate each port into a service and decide how that service should be enumerated. FTP may expose files, SSH may provide remote access, HTTPS may expose a web application, SMB may reveal users or shares, and RDP may provide an interactive Windows session.

If FTP is exposed, connect to the service and inspect the available files. Files stored on an FTP server may provide configuration data, backups, credentials or other information relevant to the lab.

The objective of service enumeration is to gather enough context to make the next action intentional. Before trying credentials or modules, identify the software, version, configuration and any publicly accessible resources associated with the service.

When a web application is identified as WordPress, WPScan can enumerate WordPress-specific information. Plugin enumeration is particularly useful because plugins add functionality and also expand the application attack surface.

Identifying installed plugins is only the first step. The plugin name, installed version and configuration should be recorded so they can be compared with known issues during an authorised assessment.

Metasploit should normally be used after enumeration has identified a technology or service worth investigating. Searching by product, protocol or vulnerability keeps the workflow tied to evidence gathered during reconnaissance.

SSH provides an authenticated shell on Linux and Unix-like systems. Access may use a password or a private key. Private SSH keys normally require restrictive local file permissions before the SSH client accepts them.

After obtaining a shell, the focus moves from remote service enumeration to local system enumeration. At this point, identify the current user, privileges, accessible files, running services and possible paths to a higher-privileged account.

Local enumeration tools can help collect system information, but understanding how files are transferred is equally important. The source material uses wget for downloading and SCP for transferring files through an existing SSH session.

Tools such as LinPEAS can quickly identify interesting permissions and configurations, but their results should be validated manually. A useful finding is not simply something highlighted by a script: you should understand why the configuration matters and what privilege boundary it affects.

One of the first Linux privilege checks should be sudo -l. It shows which commands the current account is permitted to execute through sudo and under which restrictions.

A permitted command becomes interesting when it can perform actions outside its expected purpose, interact with files, execute other programs or otherwise cross a privilege boundary. The original lab example uses Nano executed through sudo.

SMB is a key Windows and Active Directory protocol. Enumeration can reveal users, available shares and whether anonymous or guest access is permitted. These findings can provide additional information even before valid credentials are available.

A NULL session attempts to interact with SMB without supplying a username or password. Guest access uses the Guest account. Whether either method works depends on the server configuration and security policy.

If an authorised lab provides candidate credentials, Hydra can test authentication against supported services. In the source example, RDP is used as the target protocol. Credential testing should be controlled because repeated authentication attempts can trigger lockouts and monitoring systems.

Once valid credentials have been identified, RDP provides an interactive Windows desktop. xfreerdp can establish the session directly from Linux and optionally define the screen dimensions.

After obtaining a Windows session, determine the current security context. User privileges and group memberships reveal what the current account is allowed to do and may expose important differences between a standard user and an administrative context.

Scheduled tasks execute programs or scripts according to configured triggers and security contexts. Reviewing them can reveal scripts, executable paths, service accounts and recurring administrative operations.

When a scheduled task or other privileged process references a script, inspect the permissions on that file. If a lower-privileged user can modify a file that is later executed by a more privileged context, the permission boundary deserves further investigation.

A temporary HTTP server is a simple way to expose files from a lab machine. Python includes a built-in HTTP server that can serve the contents of the current directory.

Windows can retrieve files from an HTTP server using PowerShell. The source material demonstrates downloading and executing an enumeration script directly from a temporary HTTP server.

The important part of this workflow is that each phase feeds the next one. Reconnaissance identifies services, service enumeration identifies possible access paths, authenticated access provides a local security context, and local enumeration determines whether that context can reach additional resources or privileges.

Record hosts, ports, services, versions, usernames, discovered files, authentication methods and privilege findings as they appear. A good penetration test is not only about gaining access; it should leave a clear trail explaining how each finding led to the next.

The core pentesting cycle is enumeration, validation and deeper enumeration. Avoid jumping directly from an open port to exploitation. First understand the exposed service, gather evidence, validate the possible access path, and then reassess the system from the new security context.