Pentest operation rules

• Prepare the pentest.
  • At the beginning of the week, check if you have everything for the next week's project.
  • Send a reminder to the customer if not.
  • See also our pentest planning process
• Work together as a team.
  • Exchange ideas with your colleagues at least once a day during the test by calling each other in person.
  • Create a Signal group with disappearing messages (match the duration of the testing time frame e.g. 1 week) at the start of the test. Use this group for ongoing communication and sharing test-related information.
  • Be available for your colleagues (via Signal, Signal Desktop, or Nextcloud Talk).
  • Clarify who is responsible for testing and reporting what, so everyone knows their tasks (like who writes which finding, who covers what types of test to avoid redundancies, etc.)
• Take your pentest notes in the SysReptor project.
  • This allows collaboration with other pentesters.
  • Notes will be archived (encrypted) automatically.
• Also store scoping notes and other information in the SysReptor project notes.
• If you need to store files related to a pentest on your local PC, store them in one dedicated directory.
  • If you store files elsewhere, remove customer and project related information.
  • Project files older than 90 days should be deleted. For this we have a semi-automatic script, checkout Project Retention for more information.
• Save Burp projects on disk; don't use temporary projects.
  • Burp states might serve as evidence.
  • You will probably need the state for retests.
  • If possible, use repeater tabs and/or the Burp Organizer to document attacks to be able to reproduce them.
• Use a dedicated browser or the Chromium Browser integrated with Burp.
  • Don't use the browser that you use for your own work.
  • You can install the Bitwarden extension there to have your passwords available.
  • Use multiple user profiles or Firefox Multi-Account Containers (e.g., for testing authorizations of multiple users).
  • Use dedicated profiles or containers for each pentest or delete all data from the profile between pentests.
  • If you need to use Chrome, here's the command to launch it from PowerShell: & "C:\Program Files\Google\Chrome\Application\chrome.exe" --proxy-server="http://127.0.0.1:8080"
    • Might be necessary for translation, or speech recognition
    • Import your burp CA certificate (which you get on http://burp)
• Use a VPN exit node with static IP address 91.99.251.12 (if applicable, e.g., if public web application).
  • This allows the customer to identify your activities.
  • Note that nmap scans don't use the exit node by default! (You can use -sT instead of -sS to prevent this.)
• Disable email notifications.
  • Don't be distracted by email notifications and envelope symbols in app icons.
  • You may use Signal to keep in touch with your colleagues.
• Answer customer mails within 24 hours.
  • No real time communication needed for emails
  • Still, check your mails twice a day and respond to urgent or potentially long-to-prepare topics (like infrastructure/user setup for pentest preparation).
  • If your response will take longer than 24 hours, write back you will contact them later.
• Write efficiently, e.g.
  • Someone asks for a meeting; instead of answering "yes" provide three time slots.
• Customers should have the phone number of at least one pentester.
  • Sending an email incl. email signature is sufficient.
  • Be reachable during pentests for emergency cases.
• We try to present intermediate results ("interim briefing call") to the customers during the pentest.
  • This allows us and the customer to gain knowledge, we demonstrate that we have insights to the application already and demonstrated what we achieved so far.
• We also do debriefing calls if customers ask for them.
• We never decline customers' ask for presentation meetings. This is our chance to demonstrate the value of our work.