Chapter 1

1. Yes, there is. There's a CWE list maintained by MITRE that can be found at https://cwe.mitre.org/.

2. The OWASP Top 10 can be found at https://owasp.org/www-project-top-ten/, while the SANS Top 25 can be found at https://www.sans.org/top25-software-errors/.

3. Many of the tools that are used in a typical penetration test are open source, such as Nmap, and the Metasploit framework. However, there are some really efficient tools on the market that can be used as well, including BurpSuite Professional and Nessus Professional.

4. An OSSTMM penetration test can be one of six different types, depending on the nature and scope of the engagement. PTES-based penetration tests are categorized under very generic test types, such as white box, gray box, and black box. As PTES is the industry standard, most penetration tests use the PTES methodology.

...