◇ OpenCyber Academy
Professional · Chapter 4 · English

Chapter 4 — Core methods

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 4 — Core methods

Lesson map

Lesson 04 published. Map, example, EX016.

flowchart TD
  N0["Learning outcomes"]
  N1["4.1 PTES backbone"]
  N2["4.2 Discovery versus validation"]
  N3["4.3 Constrained exploitation"]
  N4["4.4 Matching methods to ROE"]
  N5["4.5 Threat modelling light"]
  N6["4.7 Reporting as a method stage"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX016"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["4.1 PTES backbone"]
  N2["4.2 Discovery versus validation"]
  N3["4.3 Constrained exploitation"]
  N4["4.4 Matching methods to ROE"]
  N5["4.5 Threat modelling light"]
  N6["4.7 Reporting as a method stage"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX016"]

[Learning outcomes]
    |
    v
[4.1 PTES backbone]
    |
    v
[4.2 Discovery versus validation]
    |
    v
[4.3 Constrained exploitation]
    |
    v
[4.4 Matching methods to ROE]
    |
    v
[4.5 Threat modelling light]
    |
    v
[4.7 Reporting as a method stage]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX016]

Learning outcomes

You will (1) describe PTES stages in order; (2) separate discovery from validation; (3) explain why exploitation is optional and constrained; (4) choose methods that match HCU's ROE.

4.1 PTES backbone

PTES stages give a shared order: pre-engagement (scoping), intelligence gathering, threat modelling, vulnerability analysis, exploitation, post-exploitation and reporting. HCU's ROE currently allows analysis and authenticated web tests, not broad exploitation. Leo's method table therefore stops at intelligence gathering, vulnerability analysis and authenticated web tests on staging, and marks each PTES stage as allowed, not allowed or out of scope, so the CISO sees where ENG-440 stops. Exploitation and post-exploitation stay off the plan until the ROE is rewritten and re-signed; skipping ahead because a tool made it easy would break trust with the SOC. Using PTES names helps the CISO and outside firms share one vocabulary.

4.2 Discovery versus validation

Discovery lists possible issues; validation confirms them with evidence inside the rules. Tool output alone is discovery. A confirmed misconfiguration with a screenshot and business impact is a finding. An outdated-banner at confidence 0.7 is discovery until Leo confirms the version, the exposure and the impact with evidence; he checks the banner against the vendor's advisory for that version before deciding whether it is a finding at all. Only then does it become a finding with a severity and a recommendation. In Chapter 5's lab, a FLOOR of 0.6 keeps open-redirect at 0.9, outdated-banner at 0.7 and cookie-flag at 0.85, but no evidence and no impact statement still means an item stays off the findings list.

4.3 Constrained exploitation

If the ROE later allows proving a flaw, use the minimum step that shows impact, on agreed accounts, with a stop if anything unexpected happens. This course still does not teach exploit development. If HCU later allows a proof of impact, Leo uses an agreed test account that holds synthetic data only, so a proof never shows a real member's balance. He takes the minimum step that shows the issue and does not invent steps beyond the ROE. A lockout, a data leak or a host that is not staging triggers an immediate stop and a call to the emergency contact.

4.4 Matching methods to ROE

Leo's plan maps each method to an ROE line. Anything not mapped is out. Authenticated WSTG checks on staging map to allowed methods and in-scope systems. Password spraying has no line, so it is out; it would also risk locking real member accounts during payday week, which is one reason the ROE omits it. AS/400 probes have an exclusion line, so they are out. Each line in Leo's method table carries the ROE clause it relies on, so a reviewer can check the mapping line by line. Unmapped methods do not get a trial run; they wait for a written ROE update, and ENG-440 does not earn bonus points for creativity outside the table.

4.5 Threat modelling light

Even without a full red-team scenario, name the likely actors (stolen member password, phishing of staff) so checks focus on what matters to HCU. For online banking, those are the actors Leo names. That focus pushes checks toward session handling, password policy and VPN MFA, rather than obscure protocol quirks that no likely actor would use against HCU. Insider misuse and attacks on the AS/400 are left out of this light model because ENG-440 cannot test them. Naming those exclusions in the model lets the report explain why a check was or was not in scope when examiners ask.

4.6 Intelligence gathering limits

OSINT on HCU stays with public pages and published documents. Scraping member forums, buying breach data or impersonating staff are out unless the ROE explicitly allows a social-engineering scenario — which HCU's current ROE does not. Leo's collection is restricted to HCU's public website and published documents that any member of the public can open without logging in to online banking. Buying breach data or scraping member forums would gather intelligence outside the ROE and could expose real people. He does not scrape at rates that look like abuse, and he records what he collected. If a social-engineering scenario is ever needed, it gets its own written approval.

4.7 Reporting as a method stage

PTES ends with reporting because findings that never reach owners change nothing. Leo budgets time for writing and review inside the engagement window rather than treating the report as unpaid overtime after testing. For ENG-440, he blocks the last part of the Saturday window for writing and peer review, and testing that runs into that reserved time is cut short rather than squeezing out the review. If writing overruns, unfinished validation becomes an explicit gap in the report, not a silent claim of full coverage. Findings that sit only in his notes until Monday help nobody before the exam; reporting is a method stage with a clock, not an afterthought.

Worked example (synthetic HCU)

Leo's method table: OSINT on public HCU pages (allowed); authenticated WSTG checks on online banking staging (allowed); password spraying (forbidden); AS/400 probes (out of scope).

Synthetic case — Harborline Credit Union (HCU). The credit union, Leo Okonkwo and all figures are invented for teaching.

Errors and limits

Local policies and laws differ; follow HCU's authorization and your jurisdiction. This book never authorizes testing of real systems.

Exercises

Synthesis

Methods follow PTES order and the ROE; discovery becomes a finding only after validated evidence.

Continue studying — chapter 04 of 12

← Chapter 03 (draft) · Course chapter index · Chapter 05 (draft) →