PenTest-Consulting-Creator

Planning – 1-2 Weeks: Includes the contract execution, initial deposit, scheduling of resources, and review/agreement of the project Rules of Engagement (ROE).

Execution – 2-3 Weeks: This phase is when active testing of all in-scope targets is set to occur – the length of this phase varies by project and is directly related to the size/scope of the assessment.

Analysis, Documentation, and Quality Assurance – 1 Week: Document preparation including the Executive Summary Report and Technical Findings Report. This phase may also include some minimal testing and manual interactions with the in-scope targets to validate findings identified during the original execution of the test or gather more detail.

Presentation of Findings – 1 Day: Scheduled after all documentation and QA is complete, this is the final step to review findings, address questions, and wrap up the project.

Burocracy

Understand the bureaucratic part of the country you work in, whether in opening a company, even in providing services and the proper credentials to act.
Structure your portfolio of services well in PenTest, the types of tests you do and how you perform them, what methodology is used in each one?

Certifications

CEH
OSCP
eCPPT
eCPTX
eWPT
GPEN
GWAPT
CREST CPSA
CRTO
CRTL
OSWE
OSEP
CRTP
CARTP

Toolkits

What tools do you use?
Do you have trading tools?
Are there partnerships for the services you have? Whether to assist in the remediation, protection and mitigation of risk
How is the licensing of your tools? If you have a Burp, Cobalt Strike, Exploit Pack and others?

CVEs, CVSS, NVD

CVE Is a list of entries—each containing an identification number, a description, and at least one public reference—for publicly known cybersecurity vulnerabilities. CVE does not provide severity scoring or prioritization ratings for software vulnerabilities.
CVSS Operated by the Forum of Incident Response and Security Teams (FIRST) used to score the severity of software vulnerabilities identified by CVE Entries.
NVD NIST Provides a free CVSS calculator for CVE Entries.
Report your CVE When you find a 0day you can report this vulnerability to the company that owns the solution or a third party depending on the case, so waiting for a positive result and get your cve depending on the vulnerability

Tutorial Report https://drive.google.com/file/d/1pfZbOm_dExehIqGHLPtjWm2GJ4UUMMJK/view?usp=sharing

hartl3y94 / pentest-consulting-creator Goto Github PK