> For the complete documentation index, see [llms.txt](https://pnpt.adot8.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pnpt.adot8.com/external-pentest-playbook/common-pentest-findings.md).

# Common Pentest Findings

## Overview

These findings are ranked from most **Critical** to **Least**. The list is not all inclusive and is more just a list of findings commonly seen on external pentests.

1. [Insufficient  Authentication Controls](/external-pentest-playbook/common-pentest-findings/insufficient-authentication-controls.md)
2. [Weak Password Policy](/external-pentest-playbook/common-pentest-findings/weak-password-policy.md)
3. [Insufficient Patching](/external-pentest-playbook/common-pentest-findings/insufficient-patching.md)
4. [Default Credentials](/external-pentest-playbook/common-pentest-findings/default-credentials.md)
5. [Insufficient Encryption](/external-pentest-playbook/common-pentest-findings/insufficient-encryption.md)
6. [Information Disclosure](/external-pentest-playbook/common-pentest-findings/information-disclosure.md)
7. [Username Enumeration](/windows-privilege-escalation/initial-enumeration-manual/user-enumeration.md)
8. [Default Web Pages](/external-pentest-playbook/common-pentest-findings/default-web-pages.md)
9. [Open Mail Relays](/external-pentest-playbook/common-pentest-findings/open-mail-relays.md)
10. [IKE Aggressive Mode](/external-pentest-playbook/common-pentest-findings/ike-agressive-mode.md)
11. [Unexpected Perimeter Services](/external-pentest-playbook/common-pentest-findings/unexpected-perimeter-services.md)
12. [Insufficient Traffic Blocking](/external-pentest-playbook/common-pentest-findings/insufficient-traffic-blocking.md)
13. [Undetected Malicious Activity](/external-pentest-playbook/common-pentest-findings/undetected-malicious-activity.md)
14. [Historical Account Compromises](/external-pentest-playbook/common-pentest-findings/historical-account-compromises.md)