Penetration testing without a defined methodology produces inconsistent, undefensible results. Professional pentesters follow repeatable documented processes. This guide walks through the complete pentest lifecycle from scoping to final report, covering the PTES (Penetration Testing Execution Standard) and industry best practices.
Phase 1: Pre-Engagement and Scoping
The most critical phase. Every engagement requires written authorization before testing begins. Essential documents: Statement of Work (SOW) defining scope, timeline, and deliverables; Rules of Engagement (ROE) defining what is in-scope and prohibited; Emergency Contact List (24/7 contact if critical vulnerability found); legal authorization signed by an authorized party.
Scope Definition
Scope must be explicit: IP ranges and CIDR notation, domain names and subdomains, specific applications and versions, physical locations if included, out-of-scope systems that must not be tested, and testing hours (24/7 or business hours only).
Phase 2: Reconnaissance
Passive Reconnaissance (OSINT)
Gather intelligence without touching target systems: Shodan/Censys for internet-exposed services, WHOIS/DNS for infrastructure enumeration, LinkedIn/GitHub for employee enumeration and leaked credentials, Google dorks for exposed documents, theHarvester for emails and subdomains. This phase generates no logs on target systems.
Active Reconnaissance
Directly interact with target: Nmap for port scanning and service detection, Amass for subdomain enumeration, Nikto for web server misconfiguration, Gobuster/Feroxbuster for directory brute-forcing. Document every scan with timestamps and parameters for the final report.
Phase 3: Vulnerability Analysis
Map discovered services against known vulnerability databases. Tools: Nessus/OpenVAS for automated scanning, Nuclei for template-based web testing, SearchSploit for offline CVE-to-exploit matching. Prioritize by exploitability and impact in context, not just CVSS score alone.
Phase 4: Exploitation
Prove vulnerabilities are exploitable with minimum impact. Use Metasploit Framework for structured exploitation. Always test exploits in lab environment before using in production. Document: exact exploit used, timestamp, outcome, any unintended side effects. Never exploit beyond what is necessary to demonstrate impact.
Phase 5: Post-Exploitation
Demonstrate actual impact: access sensitive data, lateral movement to other systems, privilege escalation to domain admin, establish persistence. Document every action taken. Clean up all artifacts (created accounts, dropped files, modified settings) and document the cleanup process thoroughly.
Phase 6: Reporting
The report is the deliverable. A professional pentest report includes:
- Executive Summary: Non-technical overview for C-suite and board
- Scope and Methodology: What was tested, how, and when
- Findings Table: All findings sorted by severity (Critical, High, Medium, Low) with CVSSv3
- Finding Details: Description, affected systems, evidence (screenshots), impact, remediation
- Technical Appendix: Raw tool output, full scan data, testing timeline
🔗 Further Reading
FAQs
What is the PTES?
PTES (Penetration Testing Execution Standard) is a community-developed standard defining the pentest methodology across seven phases: Pre-engagement, Intelligence Gathering, Threat Modeling, Vulnerability Analysis, Exploitation, Post Exploitation, and Reporting. It provides a consistent framework for professional, repeatable engagements.
Black-box vs grey-box vs white-box testing?
Black-box: no prior knowledge (simulates external attacker). Grey-box: some information provided (credentials, architecture) – most common. White-box: full knowledge including source code and architecture – most thorough for finding vulnerabilities. Most engagements use grey-box for efficiency.
Key Takeaways
- Written authorization from an authorized party is mandatory before any testing begins
- Scope must be explicitly defined — untested systems can surprise mid-engagement
- Passive OSINT first generates no logs on target systems
- Report quality determines the business value of the engagement
- Document every action with timestamps for legal protection and reporting accuracy
Conclusion
A professional penetration test follows a repeatable methodology. Legal authorization, explicit scope, thorough documentation, and actionable reporting are the hallmarks of quality engagements. Related: Ethical Hacking Career Guide.
Sources
- PTES – pentest-standard.org
- OWASP Testing Guide – owasp.org
- NIST SP 800-115 – nist.gov
Rules of Engagement and Legal Requirements
Every penetration test must have a signed Statement of Work (SOW) defining scope, permitted techniques, excluded systems, emergency contacts, and liability. Never test systems outside the agreed scope, even if you discover them during the engagement. Maintain testing logs with timestamps for all actions taken. Provide the client a daily activity report during multi-week engagements.
Key Takeaways
- Signed SOW with explicit scope is legally required before any testing begins
- Follow PTES or OWASP Testing Guide methodology for consistent, professional engagements
- Grey-box testing provides the best balance of efficiency and coverage
- Final report must include executive summary, technical findings, CVSS scores, and remediation steps
