External Pentest Playbook

Rules of Engagement

Verifying the scope

Kicking OFF

Vulnerability Scanning

Nessus or OpenVAS

Information Gathering / OSINT

Hunting breached credentials

Find breached credentials and check for bad password policy patterns

Enumerating Valid Accounts