OPSECTLAS you are here: Network
Network

Decision Tree: External Access Only → What First?

reference

  1. Recon
  2. Enumerate
  3. Foothold
  4. PrivEsc
  5. Lateral
  6. Post-Ex

The most common start: a target IP or a range in scope and nothing else in hand. Work it in this order and never skip the enumeration.

start Unauthenticated, external only, no creds yet

  1. 1
    Host Discovery (find every live host on the range)
  2. 2
    Full Nmap Strategy (every open port, with service and version)
  3. 3
    Service Enumeration Deep Dive (dig each service for the way in)
    • any anonymous access, default creds, or exposed admin panel?
  4. 4
    Vulnerability Research Workflow (map the versions to known CVEs)
  5. 5
    Exploitation Examples (turn the best finding into a foothold)