pentest-infra-external

name

pentest-infra-external

description

External (perimeter / internet-facing) infrastructure penetration testing. Use when the user mentions external pentest, perimeter test, OSINT, subdomain enumeration, ASN, BBOT, Shodan, port scan, banner grab, service enumeration, edge-device CVEs (Ivanti, Citrix, F5, Fortinet, PAN, Sophos, MOVEit, ScreenConnect, Confluence, vCenter), credential stuffing/spraying against public portals, or cloud bucket enumeration.

Pentest — External Infrastructure

Apply 03-infra-external/ from the pentest-templates library.

Library root

$PENTEST_LIBRARY — caminho absoluto deste repositório clonado (definido pelo instalador; veja INSTALL.md).

Read 03-infra-external/00-overview.md first.

Phase order

1. 03-infra-external/01-osint.md — corporate intel, employee enum, breach corpora, GitHub leaks, document metadata, mobile app store inventory.
2. 03-infra-external/02-passive-recon.md — ASN, subdomain via passive sources, DNS, mail security, IPv6.
3. 03-infra-external/03-active-discovery.md — host-up sweep, subdomain bruteforce, vhost discovery.
4. 03-infra-external/04-port-scanning.md — TCP/UDP scan, service version detection, TLS posture.
5. 03-infra-external/05-service-enumeration.md — per-service deep enum.
6. 03-infra-external/06-vulnerability-analysis.md — nuclei + version-CVE matching + trending edge-device CVEs.
7. 03-infra-external/07-exploitation.md — validate CVEs, credential stuffing/spraying, web-app initial access.
8. 03-infra-external/08-post-exploitation.md — loot, pivot evaluation, transition to internal.

How to operate

1. Validate scope: explicit IP/CIDR/FQDN list, third-party hosting carve-outs, ROE on credential stuffing.
2. Passive before active. BBOT-led recon for the deep passive pass; mark active items with 🛰 vs ⚠ per CONVENTIONS.md.
3. Nuclei + targeted version-CVE matching for vulnerability analysis. Track edge-device CVEs current to year of engagement (see tool-mappings/03-infra-external-tools.md).
4. Each finding maps to stable ID in the relevant phase file. Generate findings via templates/finding-template.md.
5. On foothold, transition to pentest-infra-internal. Web app at the perimeter → also pentest-web-api.

When NOT to use

• Internal-only engagement → pentest-infra-internal.
• Web-app focus → pentest-web-api.

Pre-conditions

• Tester source IPs allow-listed by client SOC.
• ROE clarity on credential stuffing / spraying allowance and provider acceptable-use.
• BBOT, subfinder, amass, naabu, masscan, nuclei, httpx installed.

OPSEC

• External scans visible to many ASN observers, threat-intel feeds, blue-team. Slow + distribute for OPSEC engagements.
• Credential stuffing across Microsoft / Okta / Workspace / Citrix is detected by smart-lockout / risk-based auth — coordinate.

References inside the library

• Cheatsheet: cheatsheets/recon.md.
• Tooling: tools/install-infra.md, tool-mappings/03-infra-external-tools.md.
• Frameworks: frameworks/ptes.md, frameworks/nist-sp-800-115.md.
• Playbook: playbooks/07-osint-recon-pipeline.md.