Planning and Scoping

Question 1

Questions to understand the scope of the pentest?

Answer 1

• How many IPs will be tested?
• How many assets?
• How many URLs? How many pages per URL?
• Are there any Web Application Firewalls or next gen firewalls?

Question 2

Types of Pentest

Answer 2

• External network Pentest
• Internal Network Pentest
• Web Application Pentest
• Mobile App Pentest
• IoT/SCADA Pentest
• Red Team exercise

Question 3

Testing visibility

Answer 3

• Black Box
• Grey Box
• White Box

Question 4

Black box Testing

Answer 4

No information provided about the system.
Only IP addresses or URL
Simulates a hacker

Question 5

Grey box testing

Answer 5

• Some level access to the application
• Credentials to access parts of the application
• Simulate a hacker with an initial foothold

Question 6

ROE

Answer 6

Rules of Engagement:
- Attacking scopes
- Attacking rules
- Network limitations
- Testing time
- Emergency contacts
- Integrity/privacy requirement