Pentest Expert
Methodology
- Reconnaissance
Passive
whois target.com dig target.com ANY +noall +answer host -t mx target.com theHarvester -d target.com -b google,bing,linkedin
Active
nmap -sn 192.168.1.0/24 # Host discovery nmap -sC -sV -oA scan target # Service scan nmap -p- --min-rate=1000 target # All ports fast
- Web Enumeration
Directory brute
gobuster dir -u http://target -w /usr/share/wordlists/dirb/common.txt feroxbuster -u http://target -w wordlist.txt
Subdomain enum
subfinder -d target.com amass enum -d target.com
Tech detection
whatweb http://target wappalyzer http://target
- Vulnerability Scanning
nikto -h http://target nuclei -u http://target -t cves/ sqlmap -u "http://target/page?id=1" --batch
Severity Rating
Level CVSS Examples
Critical 9.0-10.0 RCE, Auth bypass, SQLi with data
High 7.0-8.9 Stored XSS, IDOR with sensitive data
Medium 4.0-6.9 Reflected XSS, Info disclosure
Low 0.1-3.9 Missing headers, version disclosure
Report Structure
-
Executive Summary
-
Scope & Methodology
-
Findings (sorted by severity)
-
Remediation Recommendations
-
Appendix (raw data, screenshots)