Back to Details

pentest-engagement-methodology

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Penetration Test Engagement Methodology

渗透测试项目方法论

Work through a structured, repeatable methodology for authorized penetration tests.
按照结构化、可重复的方法开展经授权的渗透测试。

When to Use

适用场景

  • You are planning or executing a penetration test with written authorization
  • You need to ensure coverage and consistency across an engagement
  • You are preparing deliverables for a client or internal stakeholder
  • 你正在规划或执行具有书面授权的渗透测试
  • 你需要确保整个项目的测试覆盖度和一致性
  • 你正在为客户或内部利益相关方准备交付物

Hard Rules

硬性规则

  1. Never test without written authorization. Verify the scope statement, rules of engagement (RoE), and emergency contacts before touching anything.
  2. Stay in scope. Check every IP, domain, and URL against the scope document before testing. If unsure, ask — do not guess.
  3. No destructive actions unless explicitly authorized: no DoS, no data destruction, no production brute-force lockouts.
  1. 绝不在没有书面授权的情况下进行测试。 在接触任何目标前，核实范围声明、交战规则（RoE）和紧急联系人。
  2. 严格遵守测试范围。 测试前，将每个 IP、域名和 URL 与范围文档进行核对。如有疑问，请询问——不要猜测。
  3. 未经明确授权，不得采取破坏性操作：不得进行 DoS，不得破坏数据，也不得在生产环境中因暴力破解而触发账户锁定。

Phases

阶段

1. Scoping and Planning

1. 范围界定与规划

  • Capture in-scope assets, out-of-scope assets, testing windows, and escalation paths
  • Identify the engagement type: black/grey/white box
  • Agree on evidence-handling and data-destruction requirements
  • Prepare the test plan and get sign-off
  • 记录范围内资产、范围外资产、测试窗口和升级路径
  • 确定项目类型：黑盒/灰盒/白盒
  • 约定证据处理和数据销毁要求
  • 制定测试计划并获得批准

2. Reconnaissance

2. 侦察

  • Passive first: certificate transparency, DNS records, public code, job postings
  • Active second: port scanning, service fingerprinting, subdomain enumeration
  • Build an asset inventory with owner notes and observed technologies
  • 先被动侦察：证书透明度、DNS 记录、公共代码、招聘启事
  • 再主动侦察：端口扫描、服务指纹识别、子域名枚举
  • 构建资产清单，标注资产负责人信息和观察到的技术

3. Vulnerability Analysis

3. 漏洞分析

  • Map the attack surface to likely vulnerability classes per technology
  • Manual verification of every finding — scanners produce noise; you produce evidence
  • Rank candidate findings by exploitability and business impact
  • 根据各项技术将攻击面映射到可能的漏洞类别
  • 手动验证每项发现——扫描器只会制造噪声，而你要产出证据
  • 根据可利用性和业务影响对候选发现进行排序

4. Exploitation

4. 漏洞利用

  • Use the least invasive proof that proves the finding (POC > payload)
  • Document: request, response, tool, version, and timestamp for every exploit attempt
  • Stop and escalate to the client if you reach a critical system boundary
  • 使用能够证明漏洞且干扰最小的证据（POC 优先于 payload）
  • 记录每次漏洞利用尝试的请求、响应、工具、版本和时间戳
  • 如果触及关键系统边界，停止测试并向客户升级处理

5. Post-Exploitation

5. 后渗透利用

  • Demonstrate impact: what data or access the foothold yields
  • Attempt privilege escalation and lateral movement only within RoE
  • Clean up: remove shells, scripts, and artifacts; record what was created where
  • 展示影响：初始立足点能够获得哪些数据或权限
  • 仅在 RoE 范围内尝试权限提升和横向移动
  • 清理：移除 shell、脚本和痕迹；记录在何处创建了什么

6. Reporting

6. 报告

  • Executive summary: business risk in plain language
  • Findings: title, severity (CVSS), affected assets, reproduction steps, evidence, remediation advice
  • Retest criteria and positive observations
  • 执行摘要：用通俗语言说明业务风险
  • 测试发现：标题、严重性（CVSS）、受影响资产、复现步骤、证据、修复建议
  • 复测标准和积极观察结果

Output Format

输出格式

Deliver: test plan, asset inventory, findings report with evidence, cleanup log, and a debrief agenda.
交付：测试计划、资产清单、含证据的测试发现报告、清理日志和复盘会议议程。