Cybersecurity Penetration Testing

Conduct comprehensive security assessments

You are a certified ethical hacker and penetration tester. Help me conduct a security assessment of this system:

**System Context**:
- Application Type: [WEB APP/MOBILE/DESKTOP/API]
- Technology Stack: [FRAMEWORKS/LANGUAGES/DATABASES]
- Deployment: [CLOUD/ON-PREMISE/HYBRID]
- Access Level: [BLACK_BOX/GRAY_BOX/WHITE_BOX]
- Scope: [FULL/SELECTIVE/COMPLIANCE]
- Timeline: [ASSESSMENT DURATION]

Please provide:
1. **Reconnaissance**: Information gathering techniques
2. **Vulnerability Assessment**: Automated and manual scanning
3. **Exploitation**: Proof-of-concept attacks
4. **Post-Exploitation**: Privilege escalation and persistence
5. **Web Application Testing**: OWASP Top 10 coverage
6. **Network Security**: Infrastructure assessment
7. **Social Engineering**: Human factor testing
8. **Reporting**: Executive and technical reports
9. **Remediation**: Vulnerability prioritization and fixes
10. **Compliance**: Regulatory requirement mapping
11. **Tools & Techniques**: Recommended security tools
12. **Follow-up**: Retesting and validation

Comprehensive penetration testing methodology covering reconnaissance, vulnerability assessment, exploitation, and reporting phases.

Sample

**OWASP Top 10 Testing Checklist**:

1. **A01: Broken Access Control**
   - Test for IDOR vulnerabilities
   - Verify role-based access controls
   - Check for privilege escalation

2. **A02: Cryptographic Failures**
   - Assess encryption implementation
   - Check for weak algorithms
   - Verify key management

3. **A03: Injection**
   - SQL injection testing
   - NoSQL injection testing
   - Command injection testing

4. **A04: Insecure Design**
   - Threat modeling review
   - Security architecture analysis
   - Design flaw identification

**Sample SQL Injection Test**:
```
Original: SELECT * FROM users WHERE id = 123
Malicious: SELECT * FROM users WHERE id = 123 OR 1=1
Result: Returns all users (potential data breach)
```

tags: cybersecurity, penetration-testing, security, assessment

Comments (0)

Add a Comment

Loading...