This skill should be used when the user asks to "plan a penetration test", "create a security assessment checklist", "prepare for penetration testing", "define pentest scope", "follow security testing best practices", or needs a structured methodology for penetration testing engagements.
Add this skill
npx mdskills install sickn33/pentest-checklistComprehensive pentest planning framework with clear phases, checklists, and practical tables
1---2name: Pentest Checklist3description: This skill should be used when the user asks to "plan a penetration test", "create a security assessment checklist", "prepare for penetration testing", "define pentest scope", "follow security testing best practices", or needs a structured methodology for penetration testing engagements.4metadata:5 author: zebbern6 version: "1.1"7---89# Pentest Checklist1011## Purpose1213Provide a comprehensive checklist for planning, executing, and following up on penetration tests. Ensure thorough preparation, proper scoping, and effective remediation of discovered vulnerabilities.1415## Inputs/Prerequisites1617- Clear business objectives for testing18- Target environment information19- Budget and timeline constraints20- Stakeholder contacts and authorization21- Legal agreements and scope documents2223## Outputs/Deliverables2425- Defined pentest scope and objectives26- Prepared testing environment27- Security monitoring data28- Vulnerability findings report29- Remediation plan and verification3031## Core Workflow3233### Phase 1: Scope Definition3435#### Define Objectives3637- [ ] **Clarify testing purpose** - Determine goals (find vulnerabilities, compliance, customer assurance)38- [ ] **Validate pentest necessity** - Ensure penetration test is the right solution39- [ ] **Align outcomes with objectives** - Define success criteria4041**Reference Questions:**42- Why are you doing this pentest?43- What specific outcomes do you expect?44- What will you do with the findings?4546#### Know Your Test Types4748| Type | Purpose | Scope |49|------|---------|-------|50| External Pentest | Assess external attack surface | Public-facing systems |51| Internal Pentest | Assess insider threat risk | Internal network |52| Web Application | Find application vulnerabilities | Specific applications |53| Social Engineering | Test human security | Employees, processes |54| Red Team | Full adversary simulation | Entire organization |5556#### Enumerate Likely Threats5758- [ ] **Identify high-risk areas** - Where could damage occur?59- [ ] **Assess data sensitivity** - What data could be compromised?60- [ ] **Review legacy systems** - Old systems often have vulnerabilities61- [ ] **Map critical assets** - Prioritize testing targets6263#### Define Scope6465- [ ] **List in-scope systems** - IPs, domains, applications66- [ ] **Define out-of-scope items** - Systems to avoid67- [ ] **Set testing boundaries** - What techniques are allowed?68- [ ] **Document exclusions** - Third-party systems, production data6970#### Budget Planning7172| Factor | Consideration |73|--------|---------------|74| Asset Value | Higher value = higher investment |75| Complexity | More systems = more time |76| Depth Required | Thorough testing costs more |77| Reputation Value | Brand-name firms cost more |7879**Budget Reality Check:**80- Cheap pentests often produce poor results81- Align budget with asset criticality82- Consider ongoing vs. one-time testing8384### Phase 2: Environment Preparation8586#### Prepare Test Environment8788- [ ] **Production vs. staging decision** - Determine where to test89- [ ] **Set testing limits** - No DoS on production90- [ ] **Schedule testing window** - Minimize business impact91- [ ] **Create test accounts** - Provide appropriate access levels9293**Environment Options:**94```95Production - Realistic but risky96Staging - Safer but may differ from production97Clone - Ideal but resource-intensive98```99100#### Run Preliminary Scans101102- [ ] **Execute vulnerability scanners** - Find known issues first103- [ ] **Fix obvious vulnerabilities** - Don't waste pentest time104- [ ] **Document existing issues** - Share with testers105106**Common Pre-Scan Tools:**107```bash108# Network vulnerability scan109nmap -sV --script vuln TARGET110111# Web vulnerability scan112nikto -h http://TARGET113```114115#### Review Security Policy116117- [ ] **Verify compliance requirements** - GDPR, PCI-DSS, HIPAA118- [ ] **Document data handling rules** - Sensitive data procedures119- [ ] **Confirm legal authorization** - Get written permission120121#### Notify Hosting Provider122123- [ ] **Check provider policies** - What testing is allowed?124- [ ] **Submit authorization requests** - AWS, Azure, GCP requirements125- [ ] **Document approvals** - Keep records126127**Cloud Provider Policies:**128- AWS: https://aws.amazon.com/security/penetration-testing/129- Azure: https://docs.microsoft.com/security/pentest130- GCP: https://cloud.google.com/security/overview131132#### Freeze Developments133134- [ ] **Stop deployments during testing** - Maintain consistent environment135- [ ] **Document current versions** - Record system states136- [ ] **Avoid critical patches** - Unless security emergency137138### Phase 3: Expertise Selection139140#### Find Qualified Pentesters141142- [ ] **Seek recommendations** - Ask trusted sources143- [ ] **Verify credentials** - OSCP, GPEN, CEH, CREST144- [ ] **Check references** - Talk to previous clients145- [ ] **Match expertise to scope** - Web, network, mobile specialists146147**Evaluation Criteria:**148149| Factor | Questions to Ask |150|--------|------------------|151| Experience | Years in field, similar projects |152| Methodology | OWASP, PTES, custom approach |153| Reporting | Sample reports, detail level |154| Communication | Availability, update frequency |155156#### Define Methodology157158- [ ] **Select testing standard** - PTES, OWASP, NIST159- [ ] **Determine access level** - Black box, gray box, white box160- [ ] **Agree on techniques** - Manual vs. automated testing161- [ ] **Set communication schedule** - Updates and escalation162163**Testing Approaches:**164165| Type | Access Level | Simulates |166|------|-------------|-----------|167| Black Box | No information | External attacker |168| Gray Box | Partial access | Insider with limited access |169| White Box | Full access | Insider/detailed audit |170171#### Define Report Format172173- [ ] **Review sample reports** - Ensure quality meets needs174- [ ] **Specify required sections** - Executive summary, technical details175- [ ] **Request machine-readable output** - CSV, XML for tracking176- [ ] **Agree on risk ratings** - CVSS, custom scale177178**Report Should Include:**179- Executive summary for management180- Technical findings with evidence181- Risk ratings and prioritization182- Remediation recommendations183- Retesting guidance184185### Phase 4: Monitoring186187#### Implement Security Monitoring188189- [ ] **Deploy IDS/IPS** - Intrusion detection systems190- [ ] **Enable logging** - Comprehensive audit trails191- [ ] **Configure SIEM** - Centralized log analysis192- [ ] **Set up alerting** - Real-time notifications193194**Monitoring Tools:**195```bash196# Check security logs197tail -f /var/log/auth.log198tail -f /var/log/apache2/access.log199200# Monitor network201tcpdump -i eth0 -w capture.pcap202```203204#### Configure Logging205206- [ ] **Centralize logs** - Aggregate from all systems207- [ ] **Set retention periods** - Keep logs for analysis208- [ ] **Enable detailed logging** - Application and system level209- [ ] **Test log collection** - Verify all sources working210211**Key Logs to Monitor:**212- Authentication events213- Application errors214- Network connections215- File access216- System changes217218#### Monitor Exception Tools219220- [ ] **Track error rates** - Unusual spikes indicate testing221- [ ] **Brief operations team** - Distinguish testing from attacks222- [ ] **Document baseline** - Normal vs. pentest activity223224#### Watch Security Tools225226- [ ] **Review IDS alerts** - Separate pentest from real attacks227- [ ] **Monitor WAF logs** - Track blocked attempts228- [ ] **Check endpoint protection** - Antivirus detections229230### Phase 5: Remediation231232#### Ensure Backups233234- [ ] **Verify backup integrity** - Test restoration235- [ ] **Document recovery procedures** - Know how to restore236- [ ] **Separate backup access** - Protect from testing237238#### Reserve Remediation Time239240- [ ] **Allocate team availability** - Post-pentest analysis241- [ ] **Schedule fix implementation** - Address findings242- [ ] **Plan verification testing** - Confirm fixes work243244#### Patch During Testing Policy245246- [ ] **Generally avoid patching** - Maintain consistent environment247- [ ] **Exception for critical issues** - Security emergencies only248- [ ] **Communicate changes** - Inform pentesters of any changes249250#### Cleanup Procedure251252- [ ] **Remove test artifacts** - Backdoors, scripts, files253- [ ] **Delete test accounts** - Remove pentester access254- [ ] **Restore configurations** - Return to original state255- [ ] **Verify cleanup complete** - Audit all changes256257#### Schedule Next Pentest258259- [ ] **Determine frequency** - Annual, quarterly, after changes260- [ ] **Consider continuous testing** - Bug bounty, ongoing assessments261- [ ] **Budget for future tests** - Plan ahead262263**Testing Frequency Factors:**264- Release frequency265- Regulatory requirements266- Risk tolerance267- Past findings severity268269## Quick Reference270271### Pre-Pentest Checklist272273```274□ Scope defined and documented275□ Authorization obtained276□ Environment prepared277□ Hosting provider notified278□ Team briefed279□ Monitoring enabled280□ Backups verified281```282283### Post-Pentest Checklist284285```286□ Report received and reviewed287□ Findings prioritized288□ Remediation assigned289□ Fixes implemented290□ Verification testing scheduled291□ Environment cleaned up292□ Next test scheduled293```294295## Constraints296297- Production testing carries inherent risks298- Budget limitations affect thoroughness299- Time constraints may limit coverage300- Tester expertise varies significantly301- Findings become stale quickly302303## Examples304305### Example 1: Quick Scope Definition306307```markdown308**Target:** Corporate web application (app.company.com)309**Type:** Gray box web application pentest310**Duration:** 5 business days311**Excluded:** DoS testing, production database access312**Access:** Standard user account provided313```314315### Example 2: Monitoring Setup316317```bash318# Enable comprehensive logging319sudo systemctl restart rsyslog320sudo systemctl restart auditd321322# Start packet capture323tcpdump -i eth0 -w /tmp/pentest_capture.pcap &324```325326## Troubleshooting327328| Issue | Solution |329|-------|----------|330| Scope creep | Document and require change approval |331| Testing impacts production | Schedule off-hours, use staging |332| Findings disputed | Provide detailed evidence, retest |333| Remediation delayed | Prioritize by risk, set deadlines |334| Budget exceeded | Define clear scope, fixed-price contracts |335
Full transparency — inspect the skill content before installing.