| Ensure ROE is signed by client |
Outstanding |
|
| Add IPs in scope to Scope tab |
Outstanding |
|
| Verify customer scope |
Outstanding |
|
| Send kickoff email |
Outstanding |
|
| Conduct vulnerability scanning with Nessus |
Outstanding |
|
| Identify e-mails/users/pass in breach databases (Dehashed, breach-parse, etc.) |
Outstanding |
|
| Identify employees & email address format (LinkedIn, phonebook.cz, clearbit, hunter.io, etc.) |
Outstanding |
|
| Identify client’s website(s) and search for any data useful to help attack (job posting, system information, password policy, etc.) |
Outstanding |
|
| Attempt to enumerate any accounts on portals, password reset functions, etc. |
Outstanding |
|
| Run web app scans, if necessary |
Outstanding |
|
| Conduct manual testing and exploitation on targets |
Outstanding |
|
| Validate scanning tool vulnerabilities |
Outstanding |
|
| Conduct password spraying guessing and brute force on login portals |
Outstanding |
|
| Escalate access from external to internal |
Outstanding |
|
| Validate previous year findings have been resolved |
Outstanding |
|
| Cleanup |
Outstanding |
|