VAPT checklist with commands and tools
1. Pre-Engagement Activities
- Determine the assets to be tested.
- Identify inclusion and exclusion criteria.
- Define boundaries of the assessment.
- Specify testing types (e.g., external, internal).
- Document the scope for stakeholder review.
- Draft a formal engagement letter.
- Ensure all parties sign the agreement.
- Include liability clauses and limitations.
- Clarify confidentiality terms.
- Store signed documents securely.
- List individuals responsible for the project.
- Identify technical contacts for coordination.
- Assign roles for communication during assessment.
- Establish escalation procedures.
- Document contact information for all stakeholders.
- Collect network diagrams and architecture.
- List critical systems and applications.
- Identify IP address ranges and assets.
- Review existing security documentation.
- Compile information on prior assessments.
- Define acceptable testing hours.
- Outline communication protocols during testing.
- Specify how findings will be reported.
- Agree on response times for issues found.
- Ensure understanding of escalation procedures.
2. Reconnaissance
- Use `whois` to gather domain registration details.
- Run `dig` to query DNS records.
- Utilize `nslookup` to find IP addresses associated with domains.
- Employ `nmap` to scan for open ports on a target.
- Use `masscan` for faster network scanning of large ranges.
- Run `nmap -sV` to detect service versions on open ports.
- Execute `nmap -sS` for a stealth SYN scan to identify services.
3. Vulnerability Assessment
- Select target IP range or domain.
- Choose preferred tool (Nessus, OpenVAS, Qualys).
- Configure scan settings (credentials, plugins).
- Launch the scan and monitor progress.
- Review scan results for identified vulnerabilities.
- Set up Burp Suite or OWASP ZAP.
- Configure browser to route traffic through the tool.
- Perform passive and active scans on the application.
- Review findings for vulnerabilities and weaknesses.
- Generate reports for further analysis.
- Install nikto or sqlmap on your system.
- Run nikto against web server: `nikto -h
`. - Use sqlmap for SQL injection tests: `sqlmap -u
`. - Review command outputs for potential vulnerabilities.
- Document findings and recommended fixes.
4. Exploitation
- Review vulnerability reports.
- Select appropriate exploit module.
- Configure payload settings.
- Execute the exploit.
- Monitor the output for success.
- Install Metasploit using package manager.
- Launch Metasploit with `msfconsole`.
- Access Canvas through its GUI.
- Familiarize with available exploits.
- Load required plugins or modules.
- Open terminal or command prompt.
- Navigate to Metasploit installation directory.
- Run `msfconsole` to access CLI.
- Utilize `search` command to find exploits.
- Load specific exploit using `use
`.
- Start Metasploit with `msfconsole`.
- Type `use exploit/unix/webapp/php_eval`.
- Set required parameters using `set
`. - Execute exploit with `run` or `exploit` command.
- Check for successful exploitation messages.
- Check session list for active sessions.
- Use `sessions -i
` to interact. - Run `sysinfo` to gather system details.
- Perform network enumeration with `ipconfig` or `ifconfig`.
- Capture sensitive data or credentials.
5. Post-Exploitation
- Identify sensitive data accessed.
- Evaluate the potential damage.
- Document affected systems and users.
- Analyze network traffic for anomalies.
- Determine if data was exfiltrated.
- Gather system logs and application logs.
- Capture network traffic data.
- Take snapshots of compromised systems.
- Document timestamps and user actions.
- Preserve evidence for forensic analysis.
- Install backdoors or web shells.
- Create persistent user accounts.
- Use scheduled tasks for re-entry.
- Implement secure communication channels.
- Ensure compliance with legal and ethical standards.
- Use netcat for creating reverse shells.
- Script reverse shells for automated access.
- Configure firewalls to allow connections.
- Test connectivity and reliability of shells.
- Document configurations for future reference.
6. Reporting
- Gather all VAPT results and observations.
- Organize data into relevant categories (e.g., vulnerabilities, risks).
- Use a clear and consistent format throughout the document.
- Include graphs and charts for visual representation.
- Ensure all findings are backed by evidence.
- Summarize key findings in non-technical language.
- Detail technical vulnerabilities with specific examples.
- Outline actionable remediation steps for each finding.
- Highlight priority issues requiring immediate attention.
- Ensure clarity for both technical and non-technical stakeholders.
- Identify key stakeholders and their availability.
- Propose several dates and times for the meeting.
- Prepare an agenda outlining discussion topics.
- Send calendar invites with necessary details.
- Ensure all stakeholders receive the report in advance.
- List short-term and long-term solutions for vulnerabilities.
- Suggest tools and methodologies for ongoing security.
- Include training and awareness programs for staff.
- Encourage regular security assessments and audits.
- Highlight the importance of a security-first culture.
7. Remediation and Retesting
- Collaborate with development and security teams.
- Identify root causes of vulnerabilities.
- Implement security patches or code changes.
- Follow best practices for secure coding.
- Establish a timeline for remediation tasks.
- Utilize original VAPT tools for consistency.
- Perform targeted scans on fixed issues.
- Verify that vulnerabilities are no longer present.
- Document any new findings during retesting.
- Schedule retesting after remediation is completed.
- Use tools like Nessus, OpenVAS, or Burp Suite.
- Ensure tools are updated to latest versions.
- Run comprehensive scans to evaluate security.
- Adjust configurations for specific test scenarios.
- Review tool outputs for any new vulnerabilities.
- Maintain a log of all remediation activities.
- Include details on vulnerabilities addressed.
- Track improvements in security posture.
- Share documentation with relevant stakeholders.
- Review documentation for completeness and accuracy.
8. Continuous Monitoring
- Select appropriate monitoring tools.
- Define critical assets and metrics.
- Set up alerts for anomalies and breaches.
- Integrate with existing security protocols.
- Regularly review monitoring configurations.
- Install and configure chosen tools.
- Customize dashboards for visibility.
- Implement log management strategies.
- Ensure data retention policies are in place.
- Train staff on tool usage.
- Determine assessment frequency based on risk.
- Assign responsibilities for conducting assessments.
- Document and track assessment results.
- Adjust schedules based on asset changes.
- Communicate findings to relevant stakeholders.
- Subscribe to vulnerability databases and feeds.
- Attend cybersecurity webinars and conferences.
- Join relevant security forums and communities.
- Regularly review CVE listings and patches.
- Implement a vulnerability management process.
Use in Manifestly