The Step-by-Step Guide to External Penetration Testing
44 pages covering the full external attack chain — from passive recon and LinkedIn OSINT to breach dumps, hash capture, and WAF bypass. Written by NaviSec practitioners from real-world engagements.
What's Inside the Pentesters guide?
A five-chapter walkthrough of the full external attack chain — from open-source intelligence gathering to capturing credentials and bypassing edge security.
- Passive Recon & Asset Discovery
- LinkedIn OSINT - Building Target Email Lists
- Breach Dumps & Password Spraying
- Hash Capture & External Footholds
- Unmasking WAFs & Finding the Origin Server
44 pages. No filler. Techniques our team uses on real engagements.
A Look Inside the Guide
Here’s a sample from Chapter 3 — the kind of practical, step-by-step technique you’ll find across all five chapters.
# Query Dehashed for breached credentials associated with a target domain
curl -s -u "your@email.com:API_KEY" \
"https://api.dehashed.com/search?query=domain:target.com&size=100" \
| jq '.entries[] | .email + ":" + .password' > creds.txt
# Spray extracted credentials against OWA / M365
spray.sh -u creds.txt -p Summer2024 -t owa.target.com -o results.txt
The full guide covers 5 attack phases with tool walkthroughs, command references, and screenshots from live testing environments.
Who it's for
Penetration Testers
Looking for a structured methodology to follow on external assessments.
Red Teamers
Refining their OSINT and initial access workflows for adversary simulation engagements.
Security Students
Preparing for OSCP, CEH, or their first professional engagement.
Built by Penetration Testers for Penetration Testers
NaviSec is a Tampa-based offensive and defensive cyber security firm. Our engineers run penetration tests for Internal, External, Web Applications, IoT/Hardware devices, Physical security penetration testing, Red Team, Purple Team and more. NaviSec provides defensive services such as SOC/SIEM, Managed Detection and Response (MDR), and secure infrastructure design utilizing Fortinet and Cato Networks. We operate in nearly every industry including government, healthcare, finance, and manufacturing. We have pen tested jails, pasta factories and everything in between!
We have used this cheat sheet internally for many years and are releasing it now to the community. We will be releasing more content soon and will be better organizing or blogs. Stay tuned!
FRequently Asked Questions
Q: What is OSINT in penetration testing?
OSINT (Open-Source Intelligence) is the practice of collecting publicly available information about a target — domains, IP addresses, employee names, email formats, and more — before any active testing begins. It’s the first phase of every external engagement and often the most underestimated.
Q: What is password spraying and why it is used instead of brute-forcing?
Password spraying tries a single common password (like “Summer2024”) against many accounts rather than many passwords against one account. This avoids triggering lockout policies that most organizations have enabled. When combined with breach credential data, it’s one of the highest-yield techniques in external assessments.
Q: What are breach dumps and how are they used in pentesting?
Breach dumps are datasets of credentials exposed in past data breaches. Pentesters use services like Dehashed to identify whether target employees’ emails and passwords have been previously leaked. Reused passwords are extremely common — credentials from a 2018 breach frequently still work today.
Q: How do penetration testers find the origin server behind a WAF?
Common techniques include checking historical DNS records (before the WAF was added), searching Shodan and Censys for the server’s SSL certificate, analyzing email headers, and triggering server-side requests to a Burp Collaborator listener. Chapter 5 of this guide walks through each method.
Q: Is this reference free?
Yes. Enter your email above and we’ll send it directly to your inbox. No credit card, no catch. You’ll also receive occasional emails from NaviSec about new resources and guides — unsubscribe any time.
Q: Does NaviSec offer penetration testing services?
Yes. NaviSec provides Black Box and White Box penetration testing, Red Team engagements, and CMMC compliance operations. Visit navisec.io/services or contact us at sales@navisec.io to discuss an engagement.