Penetration Testing Stages

Core Philosophy

Unlike a strict circular process, effective pen-testing happens in interdependent stages. A rigid step-by-step guide often fails because every environment is unique. Testers must constantly adapt their TTPs (Tactics, Techniques, and Procedures) based on the specific results of the previous stage.

• Defining the rules and scope before testing begins.

• Activities: Educating the client, adjusting contracts, face-to-face planning.

• Key Deliverables: NDA, Goals, Scope, Time Estimation, Rules of Engagement (RoE).

• Reconnaissance to map the attack surface.

• Goal: Identify target company details, software, and hardware to find potential entry points.

• Analyzing data from the gathering stage to identify specific weaknesses.

• Method: Manual analysis and automated scanning.

• Goal: Determine threat levels, susceptibility to attacks, and potential vectors.

• The active phase of gaining access.

• Action: Executing attacks against identified vectors to gain an initial foothold on target systems.

• Securing access and determining impact.

• Key Actions: Persistence (maintaining access), Privilege Escalation (gaining higher rights), and Pillaging (hunting for sensitive data and credentials).

• Moving deeper into the network.

• Process: Using compromised hosts to access other internal hosts (iterative process).

• Example: Web Server → Local Admin → Database Server → Sensitive Data.

• Documenting the “how” to aid remediation.

• Goal: Create a step-by-step narrative of the attack chain so the client can prioritize fixes.

• Output: Detailed logs or automated scripts to reproduce findings.

• Reporting, cleanup, and handover.

• Activities: Removing traces (cleanup), report walkthrough, executive presentation, and data archiving.