| name | playbook-infra |
| description | Infrastructure pentest playbook — PTES-based phase flow for internal networks, servers, and non-web services. Load at the START of an internal/infra engagement or multi-host network assessment. Triggers - internal network, subnet/CIDR scan, infra pentest, multi-host, pivoting, lateral movement across services. |
Infrastructure Pentest Playbook
Based on PTES (Penetration Testing Execution Standard).
Scope Verification
Before starting:
- Confirm target IPs/CIDRs are authorized
- Identify excluded hosts/services
- Note time windows and rules of engagement
- Verify emergency contacts
Phase Flow
1. Passive Reconnaissance
- WHOIS, DNS records, ASN mapping
- Subdomain enumeration (passive sources only)
- Certificate transparency logs
- Shodan/Censys for exposed services
- Goal: Map attack surface without touching targets
2. Active Enumeration
- Host discovery:
nmap -sn <cidr>
- Port scan:
nmap -sS -p- --min-rate 5000 <targets>
- Service detection:
nmap -sV -sC -p <ports> <targets>
- OS detection:
nmap -O <targets>
- UDP top ports:
nmap -sU --top-ports 50 <targets>
- Protocol-specific enumeration (SMB, LDAP, SNMP, NFS, RPC)
- Goal: Complete inventory of hosts, ports, services, versions
3. Vulnerability Assessment
- Automated:
nuclei -severity critical,high + nmap --script vuln
- CVE search for every versioned service:
searchsploit <service> <version>
- Default credential checks on all login services
- SSL/TLS configuration:
sslscan, testssl.sh
- Misconfiguration checks (open databases, exposed APIs, anonymous access)
- Goal: Prioritized vulnerability list with evidence
4. Exploitation
Priority order:
- Known CVEs with public exploits (critical/high)
- Default/weak credentials
- Misconfigurations allowing access
- Brute force attacks
- Manual exploitation of custom services
- Goal: Gain initial access, document every attempt
5. Post-Exploitation
- Privilege escalation on every accessed host
- Credential harvesting (files, memory, databases)
- Lateral movement with found credentials
- Network pivoting to unreachable segments
- Data discovery (sensitive files, databases, secrets)
- Goal: Demonstrate maximum impact, document attack path
6. Reporting
- Executive summary with risk rating
- Technical findings by severity (CVSS scoring)
- Attack path narrative with evidence
- Remediation recommendations prioritized by risk
- Host summary table
Tool Arsenal
Scanning: nmap, masscan, nuclei, nikto
Enumeration: enum4linux-ng, ldapsearch, snmpwalk, gobuster
Exploitation: metasploit, searchsploit, hydra, crackmapexec
Post-exploit: linpeas/winpeas, mimikatz, impacket suite
Reporting: custom report generator
