All that project management talk leads us to note taking.
There are a couple of aspects here that we need to consider.
First, to get to the scope, goals, objectives,
and scheduling, we need to be able to listen to our clients and take good notes.
We need to fully understand what's required and why.
Secondly, during our engagement,
the notes we take are critical because what we identify during the
test needs to make its way to our final report.
So let's take a few minutes and review some note‑taking
apps and the skills for good notes.
Here, by the way, is what I try to do.
I've always been awful at taking notes and so always
look for a way to improve that.
These next couple of slides cover my specific approach to note taking.
Let's begin by looking at what's needed for project management note taking.
Write your notes in clear and concise phrases.
Don't just repeat what was said.
Interpret what was said, and write down that statement.
Repeat it to the group to make sure you've captured the
essence of what's being discussed.
Identify different areas of discussion with headings.
Use bullets and numbered lists to identify high‑level tasks or
specific steps that need to be performed in order.
Lastly, things that you feel are important should be highlighted,
underlined, or starred.
This helps you identify the key things later on when you're not in
the meeting and have to rely on your notes and memory of what was
said and why and what was deemed important.
Pen testing notes are a bit different.
You can make these as long or as concise as necessary,
and you can capture different types of media such as audio,
video, screenshots, and text together.
The most important aspect of pen testing notes is to gather evidence,
intelligence,
and other details that you eventually plan to share in a report
or that help you achieve your objectives.
I often forget commands or steps that I've taken,
so short of having a video of the attack,
I'll record the different steps that I took,
which tools I used,
and which arguments I supplied to get to the results in question.
I capture screenshots at the output and make it as easy
as possible for myself to be able to recreate the attack
just by relying on my notes.
I capture my notes organized by the phase of the pen
test such as information gathering, reconnaissance,
or exploitation.
Within each of those sections, I further break things down by the tools used,
in order I might add,
and then for each tool list out things like the exact
commands and scripts that were used, any findings,
with screenshots, video, audio, or just handwritten notes.
Overall, this helps me maintain a clear picture of what I've already done,
what I found, and where it fits into my test.
During remediation, if someone were to ask me about a specific test,
I can go back to my notes and be able to explain any of
the findings based on those notes.
The downside to this is that it takes longer to write
detailed notes and takes a lot of determination.
You're always writing notes of this type with purpose.
These types of notes are typically kept in a digital notebook with
one notebook representing one penetration test.
I tend to keep these notes in great confidence and purge them after
the engagement is 100% complete and remediated.
The purging is my way of ensuring that I don't hold
onto anyone's confidential data.
These notes contain a company's secrets and vulnerabilities and in
the wrong hands could cause an actual breach.
So I make sure that I encrypt the notes that I take and password protect them.
I then also make sure that only the people who have signed a
non‑disclosure agreement can see them.
If you work on a team,
this may be your team and maybe a point of contact at the organization.
Much like the effort we put into helping organizations
secure their data through pen tests,
we need to perform that sort of due diligence on ourselves as well
and ensure that we take these things seriously and handle
third‑party data in a highly secure manner.
So based on all of that,
there are some requirements that become necessary to be
able to do what I just described.
I believe that notes should be digital,
you'll have a terrible time writing things down in
a notebook using pen and paper.
And forget about capturing any screenshots, video, or audio.
So digital is the way to go.
Next,
because I use a hierarchy where the notebook represents
the test and each section within it represents one of the
major phases of a pen test,
and then within each phase I organize my notes by the tools used,
it's important to have a note‑taking application that supports hierarchies.
I don't use a lot of levels,
and my advice here is not to get caught up in the
extremely detailed hierarchies.
Too many levels become difficult to view,
and it's something that you have to manage.
You end up with a ton of notes,
so it's important for these notes to be fully searchable.
I'll take it a step further and say that even images pasted
into your notes should be searchable.
I've often found that I may remember some piece of information,
like a specific string or an IP address,
and searching within images may be necessary because
that's where the detail is captured.
I've also mentioned it, but I like to capture my notes in various formats.
This can be text, images, video, audio, and even handwritten notes.
I like the ability to have my notes on my phone, iPad, desktop, and on the web.
So for me it's important to have a connected note‑taking application as well.
Lastly, it should be secure.
That means encrypted notes that are password protected.
There are many note applications out there.
Here are a few of the more popular ones.
We have CherryTree,
which fits the bill for the most part and is part of Kali Linux.
Next is Trilium Notes, which has some nice features as well.
Note that with CherryTree and Trilium, you could set up a secure share,
such as Dropbox or Microsoft OneDrive,
to deal with the lack of internet capability.
Next is Microsoft OneNote, which is the one that I tend to use.
It supports all of the features I previously mentioned,
including password protection.
Overall, note applications and note taking is a personal choice and preference.
Since you'll be spending a lot of time in this application,
it helps to have one that you like using and that works
with the way you like to do things.
There's no right or wrong choice here, only a personal preference,
so I suggest you take the time and review as many of these note
applications as possible until you find that right balance of
productivity and usability that you're looking for.