Reconnaissance and OSINT

PTES and OWASP Testing Standards

The Penetration Testing Execution Standard (PTES) defines seven phases: pre-engagement, intelligence gathering, threat modeling, vulnerability analysis, exploitation, post-exploitation, and reporting. OWASP's Testing Guide adds web-specific methodology. Following a standard ensures consistency across engagements and demonstrates professionalism to clients.

Building a Kali Linux Lab

Kali Linux is the industry standard attack distribution — 600+ pre-installed security tools. Set it up in VirtualBox with a host-only adapter for isolation. Create snapshots before each exercise. Complement Kali with a Windows 10 victim VM and Metasploitable 2 for a complete lab. The VulnHub site offers hundreds of downloadable vulnerable VMs.

Scoping and Rules of Engagement

Before any testing, define: in-scope IP ranges and domains, out-of-scope systems, testing window (dates/times), escalation contacts, and what to do if you find critical issues mid-test. The Rules of Engagement (RoE) document is your legal protection. Without it, penetration testing is computer crime.

# Verify Kali tools are current
sudo apt update && sudo apt full-upgrade -y

# Check key tools are available
nmap --version
metasploit-framework --version || msfconsole --version
burpsuite &

# Create a project directory structure
mkdir -p ~/pentest/client-name/{recon,scans,exploits,loot,report}
cd ~/pentest/client-name

# Start logging everything
script -a ~/pentest/client-name/session.log

# Document your lab IP layout
ip addr show eth0
arp -n