PenTest-Consulting-Creator - GitLite

KO | EN

gitlite — search

#hacktoberfest #ai #go #android #machine-learning #deep-learning #nodejs #windows #awesome #cli #awesome-list #security #pytorch #mcp

PenTest-Consulting-Creator

(★ 104)

Repository with some necessary information for you to create your PenTest consultancy

File Explorer

Download Latest Version (.zip)

- Assessment PenTest.docx
- Cronograma PenTest - Template.xlsx
- NDA PenTest 1.pdf
- NDA PenTest 2.pdf
- PCI Self Asssessment.docx
- Penetration-Testing-Scoping-Questionnaire.pdf
- Penetration_Testing_Timeline_Checklist.pdf
- PenTest CherryTree Template 1.ctb
- PenTest CherryTree Template 2.ctb
- PenTest Cost.xlsx
- PWKv1-Report.docx
- Report PenTest Example 1.pdf
- Rules of Engagement Template-a.docx
- Rules-of-Engagement 2.pdf
- sample-penetration-testing-report.pdf
- Scoping PenTest Questionare.pdf
- Scoping Questionnaire Template.docx
- TCM-Security-Sample-Pentest-Report.zip
- TDIF Penetration Test Report - Template (Release 4.6).docx
- writing-penetration-testing-report GIAC.pdf
README.md

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# PenTest-Consulting-Creator
Repository with some necessary information for you to create your PenTest consultancy

PwnDoc is a pentest reporting application making it simple and easy to write your findings and generate a customizable Docx report.
- https://github.com/pwndoc/pwndoc

Curated list of public penetration test reports released by several consulting firms and academic security groups.
- https://github.com/juliocesarfort/public-pentesting-reports

PenTest Calculator Cost
- https://go.cobalt.io/roi/
- https://www.mangoldsecurity.com/cost-estimator/

PenTest Checklist
- https://pentestbook.six2dez.com/others/web-checklist
- https://github.com/harshinsecurity/web-pentesting-checklist
- https://github.com/Hari-prasaanth/Web-App-Pentest-Checklist
- https://book.hacktricks.xyz/mobile-pentesting/ios-pentesting-checklist
- https://book.hacktricks.xyz/mobile-pentesting/android-checklist

PenTest Methodology

PTES
- http://www.pentest-standard.org/index.php/Main_Page

OSSTMM
- https://www.isecom.org/OSSTMM.3.pdf

NIST 800-115
- https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-115.pdf

ISSAF
- http://cuchillac.net/archivos/pre_seguridad_pymes/2_hakeo_etico/lects/metodologia_oissg.pdf

OWASP Test Guide
- https://owasp.org/www-project-web-security-testing-guide/assets/archive/OWASP_Testing_Guide_v4.pdf

## Timeline PenTest

Planning – Includes the contract execution, initial deposit, scheduling of resources, and review/agreement of the project Rules of Engagement (ROE).

Execution – This phase is when active testing of all in-scope targets is set to occur – the length of this phase varies by project and is directly related to the size/scope of the assessment.

Analysis, Documentation, and Quality Assurance – 1 Week: Document preparation including the Executive Summary Report and Technical Findings Report. This phase may also include some minimal testing and manual interactions with the in-scope targets to validate findings identified during the original execution of the test or gather more detail.

Presentation of Findings – 1 Day: Scheduled after all documentation and QA is complete, this is the final step to review findings, address questions, and wrap up the project.

## Burocracy

- Understand the bureaucratic part of the country you work in, whether in opening a company, even in providing services and the proper credentials to act.

- Structure your portfolio of services well in PenTest, the types of tests you do and how you perform them, what methodology is used in each one?

## Certifications

- CEH
- OSCP
- eCPPT
- eCPTX
- eWPT
- GPEN
- GWAPT
- CREST CPSA
- CRTO
- CRTL
- OSWE
- OSEP
- CRTP
- CARTP

## Toolkits

- What tools do you use?

- Do you have trading tools?

- Are there partnerships for the services you have? Whether to assist in the remediation, protection and mitigation of risk

- How is the licensing of your tools? If you have a Burp, Cobalt Strike, Exploit Pack and others?

## CVEs, CVSS, NVD

- CVE 
Is a list of entries—each containing an identification number, a description, and at least one public reference—for publicly known cybersecurity vulnerabilities. CVE does not provide severity scoring or prioritization ratings for software vulnerabilities.

- CVSS
Operated by the Forum of Incident Response and Security Teams (FIRST) used to score the severity of software vulnerabilities identified by CVE Entries.

- NVD NIST
Provides a free CVSS calculator for CVE Entries.

- Report your CVE
When you find a 0day you can report this vulnerability to the company that owns the solution or a third party depending on the case, so waiting for a positive result and get your cve depending on the vulnerability

Tutorial Report
https://drive.google.com/file/d/1pfZbOm_dExehIqGHLPtjWm2GJ4UUMMJK/view?usp=sharing

## PenTest Report Writing

- https://www.youtube.com/watch?v=J34DnrX7dTo
- https://www.youtube.com/watch?v=NEz4SfjjwvU
- https://www.youtube.com/watch?v=6QIrXgPGJhM
- https://www.cobalt.io/blog/how-to-write-an-effective-pentest-report-vulnerability-reports