Pentest Checklist

The checklist covers all six standard phases: Pre-Engagement (scope, ROE, authorization, timeline), Reconnaissance (OSINT, DNS enumeration, email harvesting, Google dorking), Scanning & Enumeration (port scanning, vulnerability scanning, SSL/TLS analysis), Exploitation (web attacks, network attacks, privilege escalation, wireless), Post-Exploitation (persistence, lateral movement, data exfiltration, credential harvesting), and Reporting (executive summary, CVSS ratings, remediation recommendations).

Authorization documentation — written permission from the asset owner — is the single most critical item. Without written authorization, penetration testing activities are illegal in most jurisdictions regardless of intent. The scope definition and Rules of Engagement (ROE) document are equally essential to define exactly which systems may be tested and what actions are permitted.

Google dorking refers to using advanced Google search operators to find information about a target that the target organization did not intend to expose publicly. Common operators include site: (restrict to a domain), filetype: (find specific file types), and inurl: (find specific URL patterns). Examples include finding exposed configuration files, login pages, or sensitive documents indexed by search engines.

Exploitation covers the active attack phase where testers attempt to breach systems: password attacks, web application attacks (SQLi, XSS, SSRF), network attacks (MITM, ARP spoofing), and social engineering. Post-Exploitation covers what happens after initial access is gained: establishing persistence, moving laterally to other systems, harvesting credentials, escalating to domain admin, and demonstrating the ability to exfiltrate data.

During testing, penetration testers install backdoors, create test accounts, upload tools, and modify configurations. All of these artifacts must be removed before the engagement ends. Cleanup verification confirms that all testing artifacts have been removed and the target environment is restored to its pre-test state. Leaving backdoors or test accounts behind creates real security risks for the client.

CVSS (Common Vulnerability Scoring System) is the industry-standard framework for rating vulnerability severity on a 0–10 scale. Including CVSS scores in pentest reports helps clients prioritize remediation by providing an objective, vendor-neutral severity rating for each finding. Scores consider factors like attack vector, attack complexity, privileges required, user interaction, and impact on confidentiality, integrity, and availability.

Yes, with adaptation. Bug bounty programs have defined scopes (typically a set of domains or APIs) and strict rules that differ from traditional pentests — for example, most programs prohibit post-exploitation activities like persistence and lateral movement. Use the Reconnaissance, Scanning & Enumeration, and Exploitation phases as guidance, but always check the specific program's rules before performing any activity.

No. The tool is purely browser-based and maintains state only during the current session. Reloading the page resets all checkboxes. For persistent tracking across an engagement, consider printing the page to PDF or taking a screenshot at the end of each testing day to record your progress.