Chapters 1 and 2

Rules of Professional Conduct

Ethical standards requiring penetration testers to act honestly, responsibly, confidentially, and within authorized boundaries.

Executive Summary

A high-level overview of the assessment, major findings, business risks, and recommended actions for management.

Technical Report

A detailed document containing vulnerabilities, evidence, exploitation steps, affected systems, and remediation recommendations.

Finding

A documented security weakness discovered during an assessment.

Stakeholders need clear risk, severity, and business impact.

Findings should include description, evidence, risk rating, and remediation.

Risk Rating

A classification indicating the potential risk associated with a discovered vulnerability.

Secure Distribution

Delivering sensitive penetration-testing reports and evidence through protected channels to authorized recipients.

Goal Reprioritization

Adjusting testing objectives and priorities when new findings, risks, or business requirements emerge.

Communication Plan

A predefined plan identifying who receives updates, what information is communicated, how frequently, and through which channels.

Out-of-Band Communication

Communication using a separate channel from the potentially compromised or monitored system.

Critical Finding Notification

Promptly notifying designated stakeholders when a severe vulnerability or dangerous condition is discovered.

Technical Impact

The direct effect of a vulnerability on systems, applications, data, or infrastructure.

Penetration Testing Framework

A structured collection of guidelines, procedures, and best practices for conducting penetration tests.

OSSTMM

Open Source Security Testing Methodology Manual; a framework emphasizing systematic security testing and operational security measurement.

CREST

Council of Registered Ethical Security Testers; an organization providing professional standards, certifications, and guidance for cybersecurity testing.

PTES

Penetration Testing Execution Standard; a methodology outlining structured phases for conducting penetration tests.

PTES – Pre-engagement Interactions

The phase establishing objectives, scope, requirements, permissions, and expectations before testing begins.

PTES – Intelligence Gathering

Collecting information about the target organization, systems, infrastructure, and potential attack surfaces.

PTES – Exploitation

Attempting to leverage identified vulnerabilities to demonstrate their actual security impact.

PTES – Post-Exploitation

Determining the value of compromised systems, accessible data, privileges, and potential lateral movement.

PTES – Reporting

Documenting testing activities, discovered vulnerabilities, evidence, business impact, and remediation recommendations.

MITRE ATT&CK

A knowledge base documenting real-world adversary tactics, techniques, and procedures (TTPs).

MITRE ATT&CK Tactic

The adversary's objective or reason for performing an action.

MITRE ATT&CK Technique

The method an adversary uses to accomplish an objective.

MITRE ATT&CK Sub-technique

A more specific variation of a documented adversary technique.

MITRE ATT&CK Procedure

A specific real-world implementation of a technique by an adversary.

TTPs

Tactics, techniques, and procedures describing how threat actors conduct attacks.

OWASP Top 10

A widely recognized awareness document identifying major web application security risk categories.

OWASP A01:2021 – Broken Access Control

Failures that allow users to access resources or perform actions beyond their authorized permissions.

OWASP A02:2021 – Cryptographic Failures

Weaknesses involving inadequate encryption, improper cryptographic implementations, or exposure of sensitive data.

OWASP A03:2021 – Injection

Untrusted input is interpreted as commands or queries, potentially allowing attackers to execute unintended operations.

OWASP A04:2021 – Insecure Design

Security weaknesses resulting from missing or inadequate security controls during application design.

OWASP A05:2021 – Security Misconfiguration

Improperly configured systems, applications, services, or security settings.

OWASP A06:2021 – Vulnerable and Outdated Components

Using software components containing known vulnerabilities or unsupported versions.

OWASP A07:2021 – Identification and Authentication Failures

Weaknesses in authentication and identity management that allow account compromise or impersonation.

OWASP A08:2021 – Software and Data Integrity Failures

Failures to verify the integrity of software, updates, or data.

OWASP A09:2021 – Security Logging and Monitoring Failures

Inadequate logging, monitoring, alerting, or incident response capabilities.

OWASP A10:2021 – Server-Side Request Forgery (SSRF)

An attacker manipulates a server into making unauthorized requests to internal or external resources.

OWASP MASVS

Mobile Application Security Verification Standard; a framework defining security requirements for mobile applications.

MASVS-STORAGE

Addresses secure storage of sensitive data on mobile devices.

MASVS-CRYPTO

Addresses proper use and implementation of cryptography in mobile applications.

MASVS-AUTH

Addresses authentication and authorization security in mobile applications.

Purdue Model

A hierarchical network architecture model used to organize industrial control systems and operational technology environments.

Purdue Level 0

Physical processes and equipment, such as sensors, actuators, and machinery.

Purdue Level 1

Basic control devices, such as PLCs and other controllers.

Purdue Level 2

Supervisory control systems, such as HMIs and SCADA systems.

Purdue Level 3

Manufacturing operations and site-level operational management systems.

Purdue Level 3.5

Industrial demilitarized zone (IDMZ) separating operational technology from enterprise IT.

Purdue Level 4

Enterprise-level business planning and logistics systems.

Purdue Level 5

External networks, such as the internet and other enterprise-connected environments.

Threat Modeling

The process of identifying potential threats, vulnerabilities, attack vectors, and security risks before or during system development.

STRIDE

A threat modeling framework identifying Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege.

Repudiation

Denying having performed an action when adequate evidence or logging is unavailable.

PASTA

Process for Attack Simulation and Threat Analysis; a risk-centric threat modeling methodology.

DREAD

A threat risk assessment model evaluating Damage, Reproducibility, Exploitability, Affected Users, and Discoverability.

Scripting

Writing instructions that automate tasks, process information, or interact with systems and applications.

Interpreted Language

A programming language generally executed by an interpreter rather than compiled into a standalone native executable beforehand.

Compiled Language

A programming language translated into machine code or another executable form before execution.

Bash

A Unix/Linux command-line shell and scripting language used to automate commands and system administration tasks.

Shebang

The first line of a script specifying the interpreter used to execute it, such as #!/bin/bash.

Bash Variable

A named storage location for information used within a script.

Bash Command Substitution

Executes a command and substitutes its output into another command or variable.

Python

A high-level interpreted programming language commonly used for automation, scripting, data processing, and security testing.

Python Module

A Python file containing reusable code, such as functions, variables, and classes.

Python Class

A blueprint for creating objects that combine data and related functionality.

PowerShell

A command-line shell and scripting language commonly used for Windows administration and automation.

PowerShell Cmdlet

A specialized command in PowerShell that performs a specific operation.

PowerShell Pipeline

A mechanism that passes objects from one command to another for further processing.

PowerShell Object

A data structure containing properties and methods that can be manipulated through PowerShell.

Logic Construct

A programming structure that controls the order and conditions under which instructions execute.

Function

A reusable section of code that performs a defined task and can accept parameters.

Parameter

An input variable passed into a function or command to influence its behavior.

Return Value

The result produced and passed back by a function after execution.

Array

A data structure that stores multiple values in an ordered collection.

Regular Expression (Regex)

A pattern used to search, match, extract, or manipulate text.

Library

A collection of prewritten code that provides functionality developers can reuse rather than writing everything themselves.

Scope

The boundaries of a penetration test, specifying authorized targets, systems, activities, and limitations.

In-Scope Asset

A system, application, network, or resource explicitly authorized for testing.

Out-of-Scope Asset

A system or resource that is excluded from the authorized penetration test.

Rules of Engagement (RoE)

A document defining the conditions, limitations, procedures, and permissions governing a penetration test.

Blackout Period

A period during which testing is prohibited, often to avoid business-critical operations or maintenance.

Data Handling Requirements

Rules governing how sensitive information discovered during testing must be accessed, stored, transmitted, and destroyed.

Stop Condition

A predefined event or circumstance requiring testing activities to immediately cease.

Safe Harbor

An agreement or provision establishing protections for authorized security research conducted within defined conditions.

Framework

A structured collection of guidelines and practices used to manage or assess cybersecurity risks.

Standard

An established set of requirements or specifications that an organization is expected or required to follow.

Policy

A high-level organizational statement establishing security expectations and requirements.

Procedure

Detailed instructions describing how a specific task or process must be performed.

Guideline

Recommended practices that provide direction but are generally less mandatory than policies or standards.

SOX

Sarbanes-Oxley Act; establishes requirements concerning corporate financial reporting and internal controls.

FISMA

Federal Information Security Modernization Act; establishes information security requirements for U.S. federal agencies and certain associated organizations.

NIST

National Institute of Standards and Technology; develops cybersecurity standards, frameworks, and guidelines.

NIST SP 800-115

Technical Guide to Information Security Testing and Assessment; provides guidance on planning and conducting security assessments.

ISO/IEC 27001

An international standard specifying requirements for establishing and maintaining an information security management system.

Memorandum of Understanding (MOU)

A document describing the understanding and intended cooperation between parties, generally without creating the same binding obligations as a contract.

Memorandum of Agreement (MOA)

A document establishing agreed-upon responsibilities and commitments between participating parties.

Master Service Agreement (MSA)

A contract establishing general terms and conditions that govern multiple services or future engagements.

Attack Surface

The total collection of potential entry points an attacker could use to interact with or compromise a system.

Dependency

A system, service, or resource required for another system or application to function properly.

Penetration Test

An authorized simulated attack designed to identify and demonstrate exploitable security weaknesses.

Vulnerability Assessment

An evaluation designed to identify, classify, and prioritize security vulnerabilities without necessarily exploiting them.