Skip to content

Penetration Testing Foothold Checklist

Phase 1: Reconnaissance & Enumeration

Port & Service Scanning

  • [ ] Full TCP port scan (nmap -p- -sV)
  • [ ] UDP port scan for relevant ports (nmap -sU -p 53,161,500)
  • [ ] Service version detection and identification
  • [ ] Check for uncommon/interesting ports

Web Application Enumeration (Port 80/443)

  • [ ] Check for vhost/subdomain redirects
  • [ ] Directory fuzzing (ffuf, dirbuster)
  • [ ] Subdomain enumeration (subdomainizer, wfuzz)
  • [ ] Vhost enumeration with wordlists
  • [ ] Recursively search for hidden files/directories
  • [ ] Check for .bak, .zip, .tar files
  • [ ] Source code review (inspect HTML comments)
  • [ ] Technology stack identification (CMS, framework, plugins)

DNS Enumeration (Port 53)

  • [ ] AXFR zone transfer attempt
  • [ ] Reverse DNS lookup
  • [ ] Record enumeration (A, MX, TXT, NS)
  • [ ] Check for DNS spoofing opportunities

SNMP Enumeration (Port 161)

  • [ ] Community string enumeration (onesixtyone)
  • [ ] Walk through OID tree (snmpwalk)
  • [ ] Extract system information, running processes
  • [ ] Search for credentials in SNMP data
  • [ ] Look for internal IPs and service ports

Phase 2: Application-Level Exploitation

Authentication Bypass

  • [ ] SQL Injection (UNION, time-based, error-based, NoSQL)
  • [ ] Default credentials
  • [ ] Weak password attacks (hydra, intruder)
  • [ ] Brute force with wordlists
  • [ ] Authentication bypass payloads (admin' OR '1'='1, admin' || 'a'=='a)

File Upload Vulnerabilities

  • [ ] File type validation bypass (extension manipulation, magic bytes)
  • [ ] Directory traversal in file naming (../scripts/shell.php)
  • [ ] Webshell upload and execution
  • [ ] Image metadata exploitation

File Inclusion (LFI/RFI)

  • [ ] PHP filter wrappers (php://filter/resource=)
  • [ ] Path traversal (../../etc/passwd)
  • [ ] Log poisoning for RCE
  • [ ] Wrapper exploitation

Injection Attacks

  • [ ] SQL Injection (all types)
  • [ ] Command injection (|, ;, &, &&, backticks)
  • [ ] LDAP injection
  • [ ] XXE/XML injection (CVE-2021-29447)
  • [ ] Template injection (SSTI, XPath)
  • [ ] XSLT injection

API & WebSocket Exploitation

  • [ ] WebSocket testing with custom payloads
  • [ ] API parameter fuzzing
  • [ ] GraphQL enumeration
  • [ ] Missing authentication checks

XML/Serialization Attacks

  • [ ] XXE leading to file read/RCE
  • [ ] Deserialization vulnerabilities
  • [ ] Object injection

Phase 3: CVE-Specific Exploitation

CMS-Specific (WordPress, Umbraco, etc.)

  • [ ] Plugin vulnerability scanning (wpscan)
  • [ ] Theme vulnerabilities
  • [ ] Version-specific CVEs
  • [ ] Configuration file exposure
  • [ ] Database credential extraction
  • [ ] Authenticated RCE via plugin upload

Framework-Specific

  • [ ] Django/Flask debug mode exploitation
  • [ ] Werkzeug debugger PIN cracking
  • [ ] Framework-specific RCE vectors

Service-Specific

  • [ ] Mattermost CVEs
  • [ ] Jenkins credential extraction
  • [ ] Rocket.Chat SQLi/RCE
  • [ ] Umbraco authentication bypass
  • [ ] DaloRadius default credentials
  • [ ] CrushFTP exploitation
  • [ ] Tomcat/AIOHTTP exploitation

Phase 4: Post-Exploitation (Initial Access)

Establishing Persistence

  • [ ] Reverse shell execution
  • [ ] Shell stabilization (pty.spawn, script -q /dev/null)
  • [ ] SSH key setup
  • [ ] Web-accessible shell upload

Credential Harvesting

  • [ ] Database credential extraction
  • [ ] Config file analysis
  • [ ] Process enumeration for running commands
  • [ ] SSH key discovery
  • [ ] Password manager exploitation
  • [ ] Git history analysis

Data Collection

  • [ ] Environment variable enumeration
  • [ ] Application data access
  • [ ] Sensitive file location (/proc/self/environ)
  • [ ] Database access and dumping
  • [ ] API token/key extraction

Phase 5: Common Pitfalls to Avoid

  • [ ] Assuming filtered ports are closed
  • [ ] Missing non-standard ports (2222, 8080, 9091, etc.)
  • [ ] Not checking process arguments for credentials
  • [ ] Overlooking configuration files in web roots
  • [ ] Missing vhost/subdomain configurations
  • [ ] Not attempting default credentials
  • [ ] Ignoring DNS data as enumeration source
  • [ ] Missing backup files (.bak, .old, .config.backup)
  • [ ] Not checking cron jobs and scheduled tasks
  • [ ] Overlooking comments in source code

Phase 6: Tool References

  • Scanning: nmap, nessus, openvas
  • Web: burp suite, ffuf, wfuzz, nikto
  • Exploitation: metasploit, searchsploit, exploit-db
  • Credentials: hashcat, john, hydra
  • DNS: dig, nslookup, dnsenum, axfr
  • SNMP: snmpwalk, onesixtyone, braa
  • Databases: sqlmap, mysql-client
  • Shells: nc, meterpreter, bash, python-pty
  • Privilege Escalation: linpeas, winpeas, gtfobins

Phase 7: Quick Win Checklist

When stuck, try these in order:

  1. Default credentials for identified service
  2. SQL injection on login/search parameters
  3. Directory traversal on file inclusion
  4. API endpoint enumeration
  5. Subdomain/vhost enumeration
  6. DNS zone transfer
  7. Known CVEs for identified software
  8. Source code review (comments, config paths)
  9. SNMP community string enumeration
  10. Weak/reused passwords from enumeration data