Penetration Testing Methodology: From Recon to Exploitation

Penetration testing is the practice of simulating cyberattacks against systems, networks, and applications to identify vulnerabilities before malicious actors can exploit them. It is a cornerstone of modern cybersecurity strategy, providing organizations with actionable intelligence about their security posture. Unlike automated vulnerability scanners that produce voluminous but often shallow reports, a skilled penetration tester thinks like an adversary, chaining together low-risk findings into attack paths that demonstrate real business impact.

The methodology behind a professional penetration test follows a structured, repeatable framework. While individual engagements vary based on scope and objectives, the core phases remain consistent: reconnaissance, vulnerability analysis, exploitation, post-exploitation, and reporting. This article provides a detailed walkthrough of each phase, the tools and techniques commonly used, and the ethical boundaries that govern every step. Whether you are preparing for a certification exam, conducting your first authorized assessment, or simply seeking to understand how security professionals evaluate defenses, this guide covers the essential workflow from initial recon through final exploitation.

Penetration Testing Phases Overview

Before diving into each phase in detail, the following table provides a high-level overview of the complete penetration testing lifecycle. Each phase builds upon the previous one, and skipping or rushing a phase typically leads to incomplete assessments and missed vulnerabilities.

Phase 1: Reconnaissance

Reconnaissance is the foundation of every penetration test. This phase involves gathering as much information as possible about the target organization, its infrastructure, personnel, and technology stack. The quality of your reconnaissance directly determines the effectiveness of subsequent phases. A thorough recon phase can reveal attack vectors that automated scanners would never discover, such as exposed development servers, leaked credentials, misconfigured cloud storage, or employees susceptible to social engineering.

Reconnaissance is broadly divided into two categories: passive reconnaissance, which gathers information without directly interacting with the target, and active reconnaissance, which involves probing the target's infrastructure directly. Both approaches are essential, and the distinction between them has legal and practical implications for how information is gathered.

OSINT Gathering

Open Source Intelligence (OSINT) collection is the starting point of any penetration test. OSINT involves gathering publicly available information from sources such as corporate websites, social media profiles, job postings, DNS records, SSL certificates, code repositories, and public databases. The goal is to build a comprehensive profile of the target organization without ever sending a single packet to their infrastructure.

Domain and DNS enumeration provides the initial attack surface. Tools like whois, dig, and dnsenum reveal domain registration details, nameserver configurations, mail exchange records, and subdomain information. Subdomain enumeration is particularly valuable because organizations often have development, staging, and internal applications exposed on subdomains that are not linked from the main website but are discoverable through DNS brute-forcing or certificate transparency logs.

The theHarvester tool automates much of this process by aggregating results from search engines, public PGP key servers, Shodan, and various DNS databases. It extracts email addresses, hostnames, IP addresses, and subdomains from a wide range of sources. Similarly, Recon-ng provides a modular framework for automating OSINT collection with modules that target specific data sources such as LinkedIn, Hunter.io, and censys.io.

Shodan and Censys are search engines for internet-connected devices. By querying these platforms with the target's IP ranges or domain names, you can discover exposed services, open ports, server banners, and device types without directly scanning the target. This passive approach is invaluable for identifying exposed services that the organization may not even be aware of, such as forgotten test servers, exposed databases, or industrial control systems.

Social media intelligence examines employee profiles on LinkedIn, GitHub, Twitter, and other platforms for information about technologies used, internal projects, organizational structure, and potential social engineering targets. Job postings are especially revealing because they often specify the exact technologies, frameworks, and versions the organization uses. A job listing asking for "experienced in Cisco ASA 9.x with AnyConnect VPN" tells you both the VPN platform and the version range to target.

Network Scanning

Active network scanning transitions from passive information gathering to directly probing the target's infrastructure. This phase requires written authorization and should only be performed within the agreed-upon scope of engagement.

Nmap is the definitive network scanning tool and is used in virtually every penetration test. A basic TCP SYN scan (nmap -sS -T4 target) sends SYN packets to target ports and analyzes the responses to determine which ports are open, closed, or filtered. The SYN scan is preferred because it never completes the TCP handshake, making it less likely to be logged by basic IDS implementations.

Service detection and version enumeration (nmap -sV -sC target) goes beyond identifying open ports to determine the exact service and version running on each port. This information is critical for the vulnerability analysis phase because specific service versions are often associated with known vulnerabilities. Nmap's default scripts (-sC) also perform additional checks such as SSL certificate enumeration, SMB signing detection, and HTTP method testing.

Masscan offers an alternative for scanning extremely large address spaces quickly. While Nmap is more accurate and provides richer service detection, Masscan can scan the entire IPv4 address space in under six minutes using asynchronous transmission techniques. For targeted penetration tests, Nmap is generally sufficient, but Masscan is invaluable when assessing large IP ranges or conducting broad reconnaissance across an entire organization's address space.

Comprehensive Nmap scans should include UDP scanning (-sU) for critical services like DNS (port 53), SNMP (port 161), and TFTP (port 69) that operate over UDP. UDP scanning is slower and less reliable than TCP scanning because UDP is connectionless and responses are not guaranteed, but ignoring UDP leaves significant blind spots in the assessment. Service version detection over UDP (-sU -sV) is particularly important for identifying SNMP configurations, DNS zone transfer vulnerabilities, and other UDP-based attack vectors.

Phase 2: Vulnerability Analysis

Vulnerability analysis transforms the raw data collected during reconnaissance into a prioritized list of potential attack vectors. This phase combines automated scanning with manual analysis to identify weaknesses that could be exploited to gain unauthorized access or achieve other engagement objectives.

Automated vulnerability scanners such as Nessus, OpenVAS, and Qualys provide broad coverage by checking target systems against databases of known vulnerabilities (CVEs). These tools are effective at identifying missing patches, misconfigurations, default credentials, and known software vulnerabilities. However, automated scanners produce false positives, miss logic flaws, and cannot chain together multiple low-severity findings into a meaningful attack path.

Manual vulnerability analysis complements automated scanning by examining the target from an attacker's perspective. This includes analyzing web application logic, testing authentication mechanisms, reviewing API endpoints, examining session management, and identifying business logic flaws that automated tools cannot detect. Manual analysis is time-consuming but often yields the most impactful findings.

The vulnerability analysis phase should produce a structured list of findings with the following information for each: the affected system or application, the specific vulnerability, the CVSS severity score, evidence of the finding, potential impact, and a recommended remediation. This structured output becomes the foundation for the exploitation phase and the final report.

Phase 3: Exploitation

Exploitation is the phase where identified vulnerabilities are validated by actually leveraging them to achieve a specific objective, such as gaining shell access, reading sensitive data, or escalating privileges. The purpose of exploitation is not to cause damage but to prove that the vulnerability is real and exploitable, demonstrating the tangible risk to the organization.

Metasploit Framework is the most widely used exploitation platform in professional penetration testing. It provides a massive library of exploits, payloads, and auxiliary modules organized into a structured workflow. A typical Metasploit exploitation sequence involves selecting an exploit module matching the identified vulnerability, configuring the target parameters (IP, port, payload options), and executing the exploit to establish a Meterpreter session on the target.

Meterpreter provides a rich post-exploitation environment with capabilities including file system access, screenshot capture, keylogging, credential harvesting, privilege escalation, and lateral movement. The flexibility of Meterpreter makes it the preferred payload for most engagements because it allows the tester to thoroughly assess the impact of the initial compromise without deploying additional tools.

When pre-built exploits are unavailable for a specific vulnerability, custom exploit development becomes necessary. This typically involves writing a proof-of-concept exploit in Python, Ruby, or C that triggers the vulnerability and achieves code execution. Custom exploitation is more time-consuming but demonstrates a deeper level of skill and often reveals attack paths that automated tools completely miss. Buffer overflow exploits, format string vulnerabilities, and deserialization attacks are common scenarios requiring custom development.

Web Application Attacks

Web applications present a unique attack surface because they are accessible through standard HTTP/HTTPS traffic and often process sensitive data. The OWASP Top 10 represents the most critical web application security risks and serves as the primary framework for web application penetration testing.

SQL injection remains one of the most devastating web application vulnerabilities. It occurs when user-supplied input is incorporated into SQL queries without proper sanitization, allowing an attacker to modify the query logic. SQL injection can lead to unauthorized data access, authentication bypass, data modification, and in some cases, operating system command execution through xp_cmdshell or similar features. For a comprehensive guide to preventing SQL injection in your own applications, see our SQL Injection Prevention guide.

Cross-Site Scripting (XSS) allows attackers to inject malicious JavaScript into web pages viewed by other users. XSS vulnerabilities can be used to steal session cookies, redirect users to phishing pages, deface websites, or deliver malware. The three main types are reflected XSS (input reflected in response), stored XSS (input permanently stored on the server), and DOM-based XSS (vulnerability in client-side JavaScript).

Broken authentication and session management flaws allow attackers to compromise user accounts through credential brute-forcing, session token prediction, cookie manipulation, or insecure password reset mechanisms. Testing for these vulnerabilities involves examining how the application handles login attempts, session creation and destruction, password policies, and multi-factor authentication implementation.

Server-Side Request Forgery (SSRF) has become increasingly relevant as modern web applications frequently make requests to internal resources. SSRF vulnerabilities allow attackers to make the server issue requests to internal services, cloud metadata endpoints, or other systems that are not directly accessible from the internet. Exploiting SSRF can lead to internal network reconnaissance, access to cloud credentials, and remote code execution in certain configurations.

Burp Suite is the primary tool for web application testing, providing an intercepting proxy, automated scanner, intruder for fuzzing, repeater for manual request manipulation, and decoder for encoding analysis. The combination of Burp Suite's automation with manual testing techniques provides comprehensive web application coverage.

Network Exploitation

Network-level exploitation targets vulnerabilities in network services, protocols, and configurations rather than web applications. These attacks typically leverage weaknesses in services like SMB, SSH, RDP, FTP, and SNMP that are exposed on internal or external network segments.

Service-specific exploits target known vulnerabilities in particular software versions. EternalBlue (MS17-010), for example, exploits a vulnerability in Microsoft's SMB implementation that allows remote code execution. When Nmap identifies a service running a vulnerable version, Metasploit likely contains an exploit module that can be used to validate the finding. The key is matching the exact service version and operating system to the appropriate exploit and payload combination.

Credential attacks are often the most efficient path to initial access. Default credentials, weak passwords, and credential reuse are pervasive problems across organizations. Tools like Hydra and CrackMapExec enable efficient brute-force and password spraying attacks against common services. Credential stuffing using databases of breached passwords is particularly effective because many users reuse passwords across personal and professional accounts.

Man-in-the-Middle (MitM) attacks exploit network positioning to intercept, modify, or relay traffic between two parties. ARP spoofing on local networks, DNS spoofing, and SSL stripping are common MitM techniques. While these attacks require network proximity to the target, they can yield credentials, session tokens, and sensitive data that provide immediate access to critical systems.

Phase 4: Post-Exploitation

Post-exploitation encompasses all activities performed after achieving initial access. The objective shifts from gaining entry to demonstrating the full potential impact of the compromise. This phase answers the critical question: "Now that we are in, how far can we go and what can we access?"

Privilege escalation is typically the first post-exploitation activity. Initial access often provides only a low-privilege user account, which limits what the attacker can accomplish. Privilege escalation exploits and techniques aim to elevate from a standard user to root or SYSTEM privileges, providing unrestricted access to the compromised system.

On Linux systems, privilege escalation vectors include misconfigured SUID binaries, kernel exploits, writable cron jobs, exposed credentials in configuration files, sudo misconfigurations, and container escape techniques. Tools like LinPEAS automate the enumeration of privilege escalation opportunities by checking hundreds of potential vectors and highlighting those with the highest probability of success.

On Windows systems, common privilege escalation paths include unquoted service paths, writable service executables, DLL hijacking, token impersonation, AlwaysInstallElevated registry keys, and kernel exploits. Metasploit's getsystem command attempts several automated privilege escalation techniques, while manual analysis using tools like WinPEAS and Seatbelt provides more comprehensive coverage.

Lateral movement extends the compromise from a single system to the broader network. Once administrative access is achieved on one machine, tools like Mimikatz can extract cached credentials, Kerberos tickets, and NTLM hashes that provide access to other systems. BloodHound maps Active Directory relationships to identify the shortest path from the compromised account to high-value targets such as domain administrators, database servers, and domain controllers.

The post-exploitation phase also includes data exfiltration assessment, where the tester demonstrates the ability to locate and extract sensitive data such as customer records, financial data, intellectual property, or credentials. This is not about actually exfiltrating data but about proving that such exfiltration is possible and measuring the volume and sensitivity of data that could be compromised.

Phase 5: Reporting

Reporting is arguably the most important phase of a penetration test. A perfectly executed technical assessment loses all value if the findings are not communicated effectively to both technical teams and executive stakeholders. The report must clearly convey what was found, how it was exploited, what the business impact could be, and how to fix it.

A professional penetration test report typically includes the following sections: an executive summary that communicates overall risk posture in business terms without technical jargon; a methodology section describing the approach, tools, and scope of the assessment; a findings section with detailed descriptions of each vulnerability including reproduction steps, evidence (screenshots and tool output), CVSS scoring, and business impact analysis; and a remediation section providing specific, actionable guidance for addressing each finding.

Findings should be organized by severity, with critical and high-severity issues presented first. Each finding must include enough detail that a system administrator with no prior knowledge of the issue could reproduce it and understand its impact. This means including the exact commands executed, the responses received, screenshots of the exploit in action, and the specific systems affected.

CVSS (Common Vulnerability Scoring System) scores provide a standardized way to communicate vulnerability severity. Each finding should include the base CVSS score along with the vector string that details how the score was calculated. While CVSS scores are useful for prioritization, the report should also include contextual risk assessment that considers the specific environment, data sensitivity, and compensating controls that may affect the actual risk level.

The report should also include a remediation roadmap that prioritizes fixes based on risk and implementation effort. Quick wins that address critical vulnerabilities with minimal effort should be identified separately from longer-term strategic improvements. This helps the organization allocate resources effectively and demonstrate progress over time.

Ethical Considerations

Penetration testing exists within a strict ethical and legal framework. The difference between a professional security assessment and criminal hacking is authorization. Every action taken during a penetration test must be justified by the signed Rules of Engagement (RoE) document, which defines the scope, timeline, permitted techniques, and escalation procedures for the engagement.

The Rules of Engagement document should explicitly define: the target systems and IP ranges authorized for testing; the permitted testing windows and time restrictions; which attack techniques are allowed (social engineering, physical access, Denial of Service); the communication channels and escalation contacts; the procedures for handling discovered zero-day vulnerabilities; data handling requirements for any sensitive information encountered; and the liability and indemnification clauses protecting both parties.

Scope creep is one of the most common ethical pitfalls in penetration testing. If during testing you discover a vulnerability on a system that is outside the authorized scope, you must stop and report it rather than exploit it. Even if the exploitation would be trivial and the intent is purely educational, performing unauthorized access is a criminal act regardless of your professional role. Document the finding and report it through the established communication channel.

Data handling during a penetration test requires extreme care. Testers may encounter sensitive data including customer PII, financial records, healthcare information, or trade secrets. This data should never be extracted from the client environment unless explicitly authorized in the RoE. Screenshots and evidence should be sanitized to remove unnecessary sensitive information, and all test data should be securely deleted upon engagement completion.

For a deeper understanding of defensive measures and how to protect your own systems against the attack vectors described in this article, consult our Darknet Marketplace Guide for 2026, which covers threat modeling and security architecture considerations from a defensive perspective.