initial-access-pentest

Initial Access Pentest

Prerequisites

• Target is in scope (scope/scope-master.txt, engagement ROE).
• Phishing and credential spraying require explicit ROE authorization.
• Social engineering must use approved pretexts and infrastructure.

Workflow

Task Progress:
- [ ] Map external attack surface (web, VPN, email, exposed services)
- [ ] Prioritize credential and service-based entry paths
- [ ] Validate findings with safe checks before exploit delivery
- [ ] Cross-reference MSF modules after vulnerability confirmation
- [ ] Document delivery chain if phishing is in scope

Phase 1: External attack surface mapping

Web and application discovery

MSF MCP (preferred):

msf_db_nmap(
  engagement_id="<id>",
  targets="<target>",
  nmap_args="-sV -sC -p 21,22,25,80,443,445,3389,5985,8080,8443"
)
msf_run_auxiliary_module(
  module_name="auxiliary/scanner/http/http_version",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 443, "SSL": true}
)
msf_run_auxiliary_module(
  module_name="auxiliary/scanner/http/dir_scanner",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 443, "SSL": true}
)

CLI fallback:

subfinder -d domain.com -o subs.txt
httpx -l subs.txt -o live.txt
whatweb -i live.txt
nuclei -l live.txt -t exposures/
gobuster dir -u https://TARGET/ -w common.txt
nmap -sS -sV -p- --open TARGET

Map: VPN portals, OWA/Exchange, Citrix, RDP gateways, admin panels, dev/staging subdomains.

VPN portal testing

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/http/http_login",
  engagement_id="<id>",
  options={"RHOSTS": "<vpn>", "RPORT": 443, "SSL": true, "TARGETURI": "/remote/login", "USERPASS_FILE": "/tmp/creds.txt"}
)
msf_search_modules(query="vpn pulse secure citrix")

CLI fallback:

# Fingerprint VPN
curl -skI https://vpn.target.com/
whatweb https://vpn.target.com/

# Credential spray (ROE throttle)
ffuf -u https://vpn.target.com/remote/login -X POST \
  -d "username=FUZZ&password=Winter2026!" -w users.txt -mc 200,302

# Check for known CVEs by version
nuclei -u https://vpn.target.com -t cves/
searchsploit "pulse secure"
searchsploit "fortinet ssl vpn"