Initial commit - 611 cybersecurity skills across all subdomains

2026-09-16 21:05:22 +03:00 · 2026-02-25 10:47:44 +01:00
commit 22a7ab1462
1765 changed files with 280648 additions and 0 deletions
@@ -0,0 +1,49 @@
+# Standards and Frameworks — External Network Penetration Testing
+
+## Primary Standards
+
+### PTES (Penetration Testing Execution Standard)
+- Website: http://www.pentest-standard.org/
+- Phases: Pre-engagement, Intelligence Gathering, Threat Modeling, Vulnerability Analysis, Exploitation, Post-Exploitation, Reporting
+- Best for: Comprehensive network penetration testing engagements
+
+### NIST SP 800-115
+- Title: Technical Guide to Information Security Testing and Assessment
+- URL: https://csrc.nist.gov/publications/detail/sp/800-115/final
+- Covers: Review techniques, target identification, vulnerability analysis, planning, execution, post-testing
+
+### OSSTMM v3 (Open Source Security Testing Methodology Manual)
+- URL: https://www.isecom.org/OSSTMM.3.pdf
+- Focus: Operational security testing across physical, wireless, telecommunications, data networks, and human channels
+
+### OWASP Testing Guide v4.2
+- URL: https://owasp.org/www-project-web-security-testing-guide/
+- Focus: Web application security testing methodology
+- Complement to network-level testing
+
+## Compliance Frameworks
+
+| Framework | Requirement | Pentest Frequency |
+|-----------|------------|-------------------|
+| PCI DSS v4.0 | Requirement 11.4 | Annual + after significant changes |
+| SOC 2 Type II | CC7.1 | Annual |
+| ISO 27001 | A.12.6, A.18.2 | Annual recommended |
+| HIPAA | §164.308(a)(8) | Annual recommended |
+| FedRAMP | CA-8 | Annual |
+
+## CVSS v3.1 Scoring Reference
+
+| Metric Group | Components |
+|-------------|-----------|
+| Base Score | Attack Vector, Attack Complexity, Privileges Required, User Interaction, Scope, Confidentiality, Integrity, Availability |
+| Temporal Score | Exploit Code Maturity, Remediation Level, Report Confidence |
+| Environmental Score | Modified Base Metrics, Security Requirements |
+
+Calculator: https://www.first.org/cvss/calculator/3.1
+
+## CVE and Vulnerability Databases
+
+- NVD (National Vulnerability Database): https://nvd.nist.gov/
+- CVE: https://cve.mitre.org/
+- Exploit-DB: https://www.exploit-db.com/
+- VulnDB: https://vuldb.com/
@@ -0,0 +1,95 @@
+# Workflows — External Network Penetration Testing
+
+## End-to-End Workflow
+
+```
+┌─────────────────┐    ┌──────────────────┐    ┌─────────────────────┐
+│ Pre-Engagement   │───>│  Reconnaissance   │───>│ Vulnerability        │
+│ - Scoping        │    │  - Passive OSINT  │    │ Analysis             │
+│ - RoE signing    │    │  - Active scanning│    │ - Automated scans    │
+│ - Legal docs     │    │  - Enum subdomains│    │ - Manual validation  │
+└─────────────────┘    └──────────────────┘    └─────────────────────┘
+                                                          │
+┌─────────────────┐    ┌──────────────────┐    ┌──────────▼──────────┐
+│   Reporting      │<───│ Post-Exploitation │<───│   Exploitation       │
+│ - Findings doc   │    │  - Priv escalation│    │ - Service exploits   │
+│ - CVSS scoring   │    │  - Persistence    │    │ - Web app attacks    │
+│ - Remediation    │    │  - Pivoting proof  │    │ - Password attacks   │
+│ - Executive brief│    │  - Evidence gather │    │ - Credential spray   │
+└─────────────────┘    └──────────────────┘    └─────────────────────┘
+```
+
+## Daily Testing Workflow
+
+```
+Morning:
+  1. Review previous day's findings
+  2. Update target list with new discoveries
+  3. Run updated scans on newly discovered hosts
+  4. Verify scan results and triage
+
+Afternoon:
+  5. Manual exploitation of high-value targets
+  6. Attempt lateral movement from compromised hosts
+  7. Document all successful and failed exploitation attempts
+
+Evening:
+  8. Compile evidence and screenshots
+  9. Update findings tracker
+  10. Plan next day's attack vectors
+  11. Communicate critical findings to client immediately
+```
+
+## Reconnaissance Sub-Workflow
+
+```
+Domain Target
+    │
+    ├── DNS Enumeration ──> Subdomain Discovery ──> IP Resolution
+    │                                                    │
+    ├── WHOIS/ASN Lookup ──> IP Range Identification ────┤
+    │                                                    │
+    ├── Certificate Transparency ──> Hidden Subdomains ──┤
+    │                                                    │
+    ├── Shodan/Censys ──> Service Fingerprinting ────────┤
+    │                                                    │
+    └── OSINT (GitHub, Pastebin) ──> Credential Leaks    │
+                                                         ▼
+                                              Master Target List
+                                           (IPs, Ports, Services)
+```
+
+## Vulnerability Triage Workflow
+
+```
+Scan Results
+    │
+    ├── Critical (CVSS >= 9.0) ──> Immediate exploitation attempt
+    │                               ──> Notify client if RCE confirmed
+    │
+    ├── High (CVSS 7.0-8.9) ──> Validate and exploit within 24h
+    │
+    ├── Medium (CVSS 4.0-6.9) ──> Validate, exploit if time permits
+    │
+    └── Low/Info (CVSS < 4.0) ──> Document, include in final report
+```
+
+## Evidence Collection Workflow
+
+```
+For each successful exploitation:
+  1. Screenshot the exploit execution
+  2. Record terminal output (script command or asciinema)
+  3. Capture network traffic (tcpdump/Wireshark)
+  4. Document exact commands/payloads used
+  5. Note timestamps (UTC)
+  6. Hash any files extracted (SHA-256)
+  7. Store evidence in organized folder structure:
+     evidence/
+     ├── {date}/
+     │   ├── {target-ip}/
+     │   │   ├── screenshots/
+     │   │   ├── terminal_logs/
+     │   │   ├── pcaps/
+     │   │   └── notes.md
+```