Checklist

Initial Enumeration

• Nmap scan

• Enumeration for Windows Machine (MUST RUN IF TARGET IS WINDOWS)

• Adding to host files

Service Enumeration

• SMB (TCP Port 139,445)

• LDAP

• FTP (TCP Port 21)

• SSH (TCP Port 22)

• SMTP (TCP Port 25)

• RDP (TCP Port 3389)

• POP3 (TCP Port 110)

• MySQL (TCP Port 3306)

• SNMP (UDP Port 161)

• Web Application Methodology

• Any other services that is running on the server

Things to find

• Any configuration files

• Any password on configuration files

• Any Keepass files (Applicable to Windows Boxes)

• Any documents (.txt, .pdf, .docs)

Getting Initial Access

• Any services that can be exploited?

• Any credentials that is leaked which can be used to get a shell?

• Any credentials to be used for exploits?

Privilege Escalation Checklist

• Windows PE Methodology

• Linux PE Methodology