Network PT checklist

External Footprints:

1.) Whois - Determine TLD
2.) Reverse DNS
3.) DNS brute force
4.) Passive Banner Grabbing

Active Footprints:

1.) Port Scans -Nmap
2.) DNS Zone Transfers (AXFR); also incremental IXFR
3.) Dig, host and nmap (use NSE!)
4.) Forward and Reverse (PTR) DNS
5.) Banner Grabbing via Telnet, netcat and nmap

Services:

1.) SMTP
2.) SNMP
3.) FTP (ProFTP and PureFTP); other FTP services
4.) Virtual hosts (vhosts) detection and enumeration:

External Target Lists:

1.) Mapping Versions
2.) Identifying Patch levels
3.) Looking for weak web applications
4.) Identify lockout threshold
5.) Identify weak ports for attacks
6.) Outdated Systems
7.) Virtulization platforms v/s VMs
8.) Identify Storage Infrastructure