Metodologi & Legalitas Pentest

Pentest tanpa izin adalah tindak pidana (CEH: ethics module). Fase CEH:

  1. Reconnaissance
  2. Scanning
  3. Gaining Access
  4. Maintaining Access
  5. Covering Tracks (dalam pentest: dokumentasi)

Siklus standar industri:

  Scoping -> Recon -> Vuln Analysis -> Exploitation
         -> Post-Exploitation -> Reporting

Dokumen wajib sebelum mulai: - Scope & rules of engagement (apa yang boleh, apa tidak) - Emergency contact & abort criteria - Get-out-of-jail letter (surat izin tertulis) Acuan: PTES, OWASP WSTG, NIST SP 800-115.