| name | performing-external-network-penetration-test |
| description | Conduct a comprehensive external network penetration test to identify vulnerabilities in internet-facing infrastructure using PTES methodology, reconnaissance, scanning, exploitation, and reporting. |
| domain | cybersecurity |
| subdomain | penetration-testing |
| tags | ["external-pentest","network-security","PTES","OSSTMM","Nmap","Metasploit","vulnerability-assessment","reconnaissance","exploitation"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
| nist_csf | ["ID.RA-01","ID.RA-06","GV.OV-02","DE.AE-07"] |
Performing External Network Penetration Test
Overview
An external network penetration test simulates a real-world attacker targeting an organization's internet-facing assets such as firewalls, web servers, mail servers, DNS servers, VPN gateways, and cloud endpoints. The objective is to identify exploitable vulnerabilities before malicious actors do, following frameworks like PTES (Penetration Testing Execution Standard), OSSTMM, and NIST SP 800-115.
When to Use
- When conducting security assessments that involve performing external network penetration test
- When following incident response procedures for related security events
- When performing scheduled security testing or auditing activities
- When validating security controls through hands-on testing
Prerequisites
- Written authorization (Rules of Engagement document signed by asset owner)
- Defined scope: IP ranges, domains, subdomains, and exclusions
- Testing environment: Kali Linux or Parrot OS with updated tools
- VPN/dedicated testing infrastructure to avoid IP blocks
- Coordination with SOC/NOC for timing windows
Phase 1 — Pre-Engagement and Scoping
Define Rules of Engagement
Scope:
- Target IP ranges: 203.0.113.0/24, 198.51.100.0/24
- Domains: *.target.com, *.target.io
- Exclusions: 203.0.113.50 (production DB), *.staging.target.com
- Testing window: Mon-Fri 22:00-06:00 UTC
- Emergency contact: SOC Lead — +1-555-0100
- Authorization ID: PENTEST-2025-EXT-042
Legal Documentation Checklist
| Document | Status | Owner |
|---|
| Master Service Agreement (MSA) | Signed | Legal |
| Statement of Work (SOW) | Signed | PM |
| Rules of Engagement (RoE) | Signed | CISO |
| Get-Out-of-Jail Letter | Signed | CTO |
| NDA | Signed | Legal |
| Insurance Certificate | Verified | Risk |
Phase 2 — Reconnaissance (Information Gathering)
Passive Reconnaissance
subfinder -d target.com -o subdomains.txt
amass enum -passive -d target.com -o amass_subs.txt
cat subdomains.txt amass_subs.txt | -u > all_subs.txt
dig target.com ANY +noall +answer
dig target.com MX +short
dig target.com NS +short
dig target.com TXT +short
whois target.com
whois -h whois.radb.net --
curl -s | jq | -u
shodan search --fields ip_str,port,product
shodan host 203.0.113.10
theHarvester -d target.com -b all -l 500 -f theharvester_results
trufflehog github --org=targetcorp --concurrency=5
gitleaks detect --=https://github.com/targetcorp/repo
