Please enable JavaScript.
Coggle requires JavaScript to display documents.
External And External Penetration Testing - Coggle Diagram
External And External Penetration Testing
Overview
Definition
Simulated real-world attack against internet-facing assets
Identifies vulnerabilities before attackers exploit them
Evaluates external security posture
Objectives
Discover exploitable vulnerabilities
Validate security controls
Measure attack surface exposure
Reduce external cyber risk
Support compliance requirements
Scope
Internet-facing applications
External IP addresses
Web applications
APIs
VPN gateways
Firewalls
Email infrastructure
Cloud services
Remote access systems
Penetration Testing Standards and Frameworks
PTES
Pre-engagement Interactions
Intelligence Gathering
Threat Modeling
Vulnerability Analysis
Exploitation
Post Exploitation
Reporting
NIST SP 800-115
Planning
Discovery
Attack Execution
Reporting
OWASP Testing Guide
Web Application Testing
API Security Testing
Authentication Testing
Authorization Testing
OSSTMM
Operational Security Testing
Network Security Assessment
Vulnerability Validation
MITRE ATT&CK
Initial Access
Discovery
Credential Access
Persistence
Privilege Escalation
Pre Engagement Phase
Rules of Engagement
Scope Definition
Testing Window
Allowed Techniques
Restricted Activities
Emergency Contacts
Authorization
Written Permission
Legal Approval
NDA Agreement
Asset Identification
IP Ranges
Domains
Subdomains
Applications
Cloud Resources
Testing Type
Black Box Testing
No Information Provided
Simulates External Attacker
Gray Box Testing
Limited Information Provided
Partial Knowledge Assessment
White Box Testing
Full Information Provided
Deep Security Assessment
External Attack Surface Discovery
Passive Reconnaissance
OSINT
Search Engine Intelligence
WHOIS Lookup
DNS Information Gathering
Certificate Transparency Logs
Public Documents
Social Media Intelligence
Active Reconnaissance
Port Scanning
Service Discovery
Banner Grabbing
Technology Detection
Network Mapping
Tools
Nmap
Masscan
Amass
Subfinder
DNSRecon
Shodan
Censys
Netcraft
Network Security Testing
Network Discovery
IP Enumeration
Port Scanning
Service Identification
Operating System Detection
Firewall Testing
Firewall Rule Analysis
Port Filtering Testing
Misconfiguration Detection
Firewall Bypass Testing
VPN Testing
VPN Gateway Discovery
Authentication Testing
Encryption Validation
Weak Protocol Detection
Network Services Testing
SSH
Weak Authentication
Brute Force Testing
Configuration Review
FTP
Anonymous Access
Weak Encryption
SMTP
Open Relay Testing
User Enumeration
DNS
Zone Transfer Testing
DNS Misconfiguration
Web Application Penetration Testing
Information Gathering
Application Discovery
Technology Identification
Directory Enumeration
Endpoint Discovery
Authentication Testing
Weak Password Testing
Brute Force Testing
MFA Testing
Password Policy Review
Session Management
Authorization Testing
Privilege Escalation
Horizontal Access Control
Vertical Access Control
IDOR Testing
Input Validation Testing
SQL Injection
Cross Site Scripting XSS
Command Injection
LDAP Injection
XML Injection
File Security Testing
File Upload Vulnerabilities
Path Traversal
Local File Inclusion
Remote File Inclusion
Session Security
Cookie Security
Session Fixation
Session Hijacking
Token Validation
Security Configuration Testing
Security Headers
TLS Configuration
Error Handling
Information Disclosure
OWASP Top 10 Testing
Broken Access Control
Cryptographic Failures
Injection
Insecure Design
Security Misconfiguration
Vulnerable Components
Authentication Failures
Software Integrity Failures
Logging Monitoring Failures
Server Side Request Forgery
API Penetration Testing
API Discovery
REST APIs
SOAP APIs
GraphQL APIs
Authentication Testing
API Keys
OAuth
JWT Tokens
Session Tokens
Authorization Testing
Object Level Authorization
Function Level Authorization
Input Testing
Injection Attacks
Parameter Manipulation
Data Exposure
API Security Tools
Burp Suite
Postman
OWASP ZAP
Swagger Analysis
Cloud External Penetration Testing
AWS Security Testing
S3 Bucket Exposure
IAM Misconfiguration
Security Group Testing
Public Resources
Azure Security Testing
Identity Testing
Storage Testing
Network Security Testing
Google Cloud Testing
IAM Review
Public Resource Testing
Cloud Tools
ScoutSuite
Prowler
CloudSplaining
Vulnerability Assessment
Vulnerability Discovery
Automated Scanning
Manual Validation
Configuration Review
Vulnerability Scanners
Nessus
Qualys
OpenVAS
Rapid7 InsightVM
Vulnerability Classification
Critical
High
Medium
Low
Informational
CVSS Analysis
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Impact Analysis
Exploitation Phase
Exploitation Process
Vulnerability Validation
Proof of Concept Development
Controlled Exploitation
Exploitation Tools
Metasploit Framework
Burp Suite
SQLMap
Hydra
Netcat
Exploitation Objectives
Gain Access
Validate Impact
Demonstrate Risk
Avoid System Damage
Post Exploitation
Impact Assessment
Data Access Validation
Privilege Escalation Testing
Internal Discovery
Persistence Testing
Backdoor Detection
Credential Testing
Cleanup
Remove Test Accounts
Remove Test Files
Restore Changes
Reporting
Executive Report
Business Risk Summary
Overall Security Rating
Major Findings
Recommendations
Technical Report
Vulnerability Details
Risk Rating
Evidence
Exploitation Steps
Remediation Guidance
Finding Structure
Vulnerability Name
Description
Severity
Affected Asset
Proof of Concept
Business Impact
Remediation
Remediation and Verification
Remediation Process
Patch Management
Configuration Hardening
Access Control Improvement
Security Architecture Improvement
Retesting
Verify Fixes
Validate Controls
Close Vulnerabilities
Enterprise Penetration Testing Tools
Reconnaissance
Nmap
Amass
Subfinder
Shodan
Vulnerability Assessment
Nessus
Qualys
OpenVAS
Web Testing
Burp Suite Professional
OWASP ZAP
Exploitation
Metasploit
SQLMap
Hydra
Reporting
Dradis
Faraday
PlexTrac
Compliance Requirements
ISO 27001
Security Testing Requirement
Risk Management
NIST Cybersecurity Framework
Identify
Protect
Detect
Respond
Recover
PCI DSS
Regular Penetration Testing
Vulnerability Management
NCA ECC Saudi Arabia
Vulnerability Management
Security Assessment
Risk Reduction
Enterprise Penetration Testing Lifecycle
Planning
Reconnaissance
Scanning
Vulnerability Analysis
Exploitation
Post Exploitation
Reporting
Remediation
Retesting
Continuous Security Improvement
Internal Penetration Testing
Enterprise Internal Penetration Testing Program
Purpose and Objectives
Identify security weaknesses inside the organization
Simulate real attacker behavior after gaining internal access
Assess internal network security posture
Validate security controls effectiveness
Identify privilege escalation paths
Test segmentation and access control
Reduce risk of insider threats
Support compliance requirements
Internal Penetration Testing Scope
Network Infrastructure Testing
Internal LAN
WAN Infrastructure
Data Center Networks
Branch Office Networks
VPN Infrastructure
Wireless Networks
Network Devices
Routers
Switches
Firewalls
Load Balancers
Server Security Testing
Linux Servers
RHEL
CentOS
Ubuntu
Debian
Windows Servers
Active Directory Servers
Domain Controllers
File Servers
Application Servers
Database Servers
Application Security Testing
Internal Web Applications
Enterprise Applications
ERP Systems
CRM Applications
API Security Testing
Thick Client Applications
Desktop Applications
Identity and Access Management Testing
Active Directory Security
LDAP Security
User Authentication
Privilege Management
Password Policies
MFA Implementation
Service Accounts
Privileged Accounts
Cloud Internal Security Testing
AWS Internal Assessment
EC2
IAM
Security Groups
VPC
S3
Azure Security Testing
Google Cloud Testing
Container and Virtualization Testing
Docker Security
Kubernetes Security
VMware Security
Hypervisor Security
Testing Methodology
Pre Engagement Phase
Define Scope
Define Rules of Engagement
Identify Assets
Define Testing Timeline
Obtain Authorization
Define Communication Channels
Define Emergency Contacts
Intelligence Gathering Phase
Asset Discovery
Network Mapping
Host Identification
Service Enumeration
Technology Identification
User Enumeration
Threat Modeling Phase
Identify Attack Paths
Identify Critical Assets
Identify Threat Actors
Map MITRE ATT&CK Techniques
Analyze Business Impact
Vulnerability Assessment Phase
Automated Scanning
Nessus
Qualys
OpenVAS
Nmap Scripts
Manual Testing
Configuration Review
Security Control Validation
Exploit Verification
Exploitation Phase
Exploit Vulnerabilities
Validate Security Impact
Gain Initial Access
Execute Controlled Attacks
Avoid Business Disruption
Privilege Escalation Phase
Linux Privilege Escalation
SUID Exploitation
Sudo Misconfiguration
Weak File Permissions
Kernel Exploits
Cron Job Abuse
Credential Discovery
Windows Privilege Escalation
Weak Service Permissions
Registry Abuse
Token Manipulation
DLL Hijacking
Scheduled Task Abuse
Post Exploitation Phase
Credential Analysis
Lateral Movement Testing
Internal Pivoting
Data Access Validation
Persistence Testing
Security Monitoring Validation
Cleanup Phase
Remove Test Accounts
Remove Payloads
Remove Backdoors
Restore Configurations
Verify System Integrity
Internal Penetration Testing Attack Areas
Network Attacks
Network Discovery
Nmap Scanning
Port Scanning
Service Detection
OS Fingerprinting
Network Exploitation
SMB Attacks
SSH Attacks
RDP Attacks
FTP Attacks
SNMP Attacks
Network Security Testing
Firewall Rules
ACL Testing
Network Segmentation
VLAN Security
IDS IPS Detection
Active Directory Security Testing
Domain Enumeration
Users
Groups
Computers
Domain Policies
Trust Relationships
Authentication Attacks
Password Spraying
Brute Force Testing
Kerberos Attacks
NTLM Attacks
Privilege Escalation
Kerberoasting
AS-REP Roasting
Pass The Hash
Pass The Ticket
Golden Ticket
Silver Ticket
Active Directory Tools
BloodHound
Mimikatz
CrackMapExec
Impacket
Server Security Testing
Operating System Hardening Review
Patch Management
Service Review
User Permissions
Firewall Configuration
SELinux Configuration
AppArmor Configuration
File System Security
Weak Permissions
Sensitive Files
Credential Files
Configuration Files
Web Application Security Testing
OWASP Top 10 Testing
Broken Access Control
Cryptographic Failures
Injection Attacks
Insecure Design
Security Misconfiguration
Vulnerable Components
Authentication Failures
Software Integrity Failures
Logging Monitoring Failures
Server Side Request Forgery
Testing Areas
Authentication Testing
Authorization Testing
Session Management
Input Validation
API Testing
File Upload Testing
Wireless Network Security Testing
Wireless Discovery
SSID Discovery
Access Point Mapping
Signal Analysis
Wireless Attacks
Weak Encryption
WPA/WPA2 Testing
Rogue Access Points
Evil Twin Attacks
Captive Portal Testing
Vulnerability Assessment Tools
Discovery Tools
Nmap
Netdiscover
Masscan
Vulnerability Scanners
Nessus
Qualys
OpenVAS
Nexpose
Exploitation Frameworks
Metasploit
ExploitDB
Web Testing Tools
Burp Suite
OWASP ZAP
Nikto
Gobuster
Password Testing Tools
Hashcat
John The Ripper
Hydra
Network Analysis Tools
Wireshark
Tcpdump
Security Frameworks and Standards
PTES
Pre Engagement
Intelligence Gathering
Threat Modeling
Vulnerability Analysis
Exploitation
Post Exploitation
Reporting
NIST SP 800-115
Planning
Discovery
Attack
Reporting
OWASP Testing Guide
MITRE ATT&CK
Initial Access
Execution
Persistence
Privilege Escalation
Defense Evasion
Credential Access
Discovery
Lateral Movement
Reporting Structure
Executive Report
Business Risk Summary
Critical Findings
Overall Security Rating
Recommendations
Technical Report
Vulnerability Details
Title
Severity
CVSS Score
Affected Assets
Description
Evidence
Exploitation Steps
Business Impact
Remediation
Risk Classification
Critical
Immediate Action Required
High
Priority Remediation
Medium
Planned Fix
Low
Security Improvement
Remediation and Validation
Remediation Planning
Patch Vulnerabilities
Fix Configurations
Improve Access Controls
Update Security Policies
Retesting
Verify Fixes
Validate Controls
Confirm Risk Reduction
Continuous Improvement
Security Monitoring
Vulnerability Management
Regular Penetration Testing
Enterprise Integration
SOC Integration
SIEM Monitoring
Alert Validation
Detection Engineering
Threat Hunting
Incident Response Integration
Attack Simulation
Response Testing
Investigation Process
Compliance Integration
ISO 27001
Risk Management
Security Controls
NIST Cybersecurity Framework
PCI DSS
NCA ECC Saudi Arabia
IEC 62443 Industrial Security
Internal Penetration Testing Team Structure
Penetration Testing Manager
Red Team Lead
Senior Penetration Tester
Network Security Tester
Web Application Tester
Active Directory Specialist
Cloud Security Tester
Vulnerability Analyst
Security Report Analyst
Enterprise Penetration Testing Frequency
Quarterly Internal Testing
Annual Full Assessment
After Major Infrastructure Changes
After Security Incidents
Before Production Deployment
Compliance Required Testing