A penetration test is only a test, when it has been authorised
While some things may be legal to do during an engagement, it could be ethically a gray area
It’s important to lay down some ground rules for myself around ethics
I like this quote *”Ethics is the moral debate between right and wrong; where an action may be legal, it may go against an individual’s belief system of right and wrong.”_
Rules of Engagement
This is a document that you do NOT want to skip over. It is essentially the rules and the “how” of the engagement. SANS Example
Permission Section
Legal protections for actions that will be carried out
Test Scope / Scope
What targets / machines the engagement should be carried out upon, in other words, what systems are fair game, and what systems are not
Rules
These are the rules and also the “hows” of the engagement. It may state you can perform a phishing attack, but not a MITM attack.
Task 3 - Methodologies, stages, and so forth.
All pentests have different end goals and objectives, so they are all different in some way. In this case methodology is the steps taken by the tester.
General Themes / Stages within each common methodology
Information Gathering
Obtain as much public information as possible about a target
No scanning is involved here. All OSINT and research
Enumeration/Scanning
Typically this means looking for applications and services within the network
Exploitation
Using vulnerabilities found in the Enum/Scanning section against a system
Could be an exploit as in a program made, or simply utilizing a bug etc to achieve the end goal whatever that may be
Privilege Escalation
Once within a system, this is where you’d attempt to expand access and permissions. Gain more control.
Horizontal Escalation - Accessing another account/user
Vertical Escalation - Accessing an administrator account, or specialized account (i.e. different group)
Post-exploitation
Figuring out where to go next, is there anything else we can gather information wise?
Covering tracks
Reporting/completing the engagement (or section)
Common Methodologies
OSSTMM -VoIP, Wireless, Wired, this is a well rounded one