Planning, scoping, and reconnaissance
Every penetration test begins with defining its scope and obtaining written authorization. The Rules of Engagement (RoE) document specifies what systems can be tested, which attack techniques are permitted or prohibited, the testing time window, how to handle sensitive data discovered during testing, and emergency contact procedures if testing causes unintended disruption. Operating without written authorization is illegal regardless of intent. The scope must be clearly documented and signed before any technical work begins.
Reconnaissance is the information-gathering phase. Passive reconnaissance collects information without directly interacting with the target systems: searching public records, LinkedIn profiles, job postings, DNS records, WHOIS data, and certificate transparency logs. This information does not trigger IDS alerts. Active reconnaissance directly interacts with target systems: DNS zone transfers, port scanning, web application crawling. Active reconnaissance may alert defenders and should only begin after written authorization.
OSINT (Open Source Intelligence) is a key passive reconnaissance technique. Tools like Shodan search the internet for exposed services (including devices that should not be publicly accessible). Maltego maps relationships between people, organizations, domains, and IP addresses. Google dorks use advanced search operators to find sensitive files, login portals, and configuration data inadvertently exposed on public websites. OSINT findings often reveal attack surface that the organization did not know was publicly accessible.
Exploitation, post-exploitation, and reporting
The exploitation phase uses discovered vulnerabilities to gain initial access to target systems. Techniques include password attacks (brute force, credential stuffing, password spraying against login portals), phishing (simulated email attacks to capture credentials or deliver payloads), vulnerability exploitation (using Metasploit or manual exploits against known CVEs), and web application attacks (SQL injection, XSS, authentication bypass). The goal is to demonstrate that a vulnerability is exploitable, not to cause damage.
Post-exploitation demonstrates the impact of a successful initial compromise. Privilege escalation moves from a low-privilege account to administrator or root. Lateral movement spreads access to other systems within the network. Persistence establishes mechanisms to maintain access (scheduled tasks, registry run keys, web shells). Data exfiltration demonstrates what an attacker could steal. Each of these steps is carefully documented with timestamps, screenshots, and command output for the final report.
The penetration test report is the primary deliverable that provides value to the client. It includes an executive summary for non-technical leadership (business impact, overall risk rating, key findings), a technical findings section for the security team (each vulnerability with evidence, CVSS score, affected systems, and remediation steps), and an appendix with raw data. Findings are prioritized by risk: critical findings with active exploitation paths appear first. Remediation recommendations must be specific and actionable, not generic.
How to choose the correct answer
Written authorization (Rules of Engagement) must exist before any testing activity, including passive reconnaissance.
Passive recon: no direct target interaction (OSINT, public records, DNS lookups on public servers).
Active recon: direct interaction with target (port scanning, banner grabbing, web crawling). More detectable.
Exploitation: demonstrate vulnerability is exploitable. Post-exploitation: demonstrate impact (privilege escalation, lateral movement, data exfiltration).
Reporting: executive summary for leadership (business risk), technical findings for security team (remediation steps).
Retesting: after client applies fixes, retest to verify remediation was effective. Not part of original pentest scope unless agreed.
Black box: no prior knowledge of target. White box: full knowledge (source code, architecture). Gray box: partial knowledge.