Hello! Welcome to the next lesson in our journey through the core tenets of penetration testing.
In our last few lessons, we've focused on essential, hands-on skills like navigating the Linux command line with cd and ls, and managing access control with chmod and chown. These are the micro-level tools of the trade. Now, it's time to zoom out and look at the big picture. How do these individual actions fit into a professional, structured engagement?
Today, we'll answer that question by exploring the high-level roadmap that guides every professional ethical hack. This brings us to our learning outcome: Describe the phases of a structured penetration testing methodology (e.g., PTES).
Understanding this framework is crucial. It’s what separates a professional penetration tester from a hobbyist. It provides the structure for everything we will cover in this course—from reconnaissance and enumeration to exploitation and reporting. Each future module will slot into one of the phases we discuss today.
1. What is a Methodology and Why Does It Matter?
Before diving into a specific framework, let's establish why we need one. Hacking without a plan is chaotic, risky, and unprofessional. A penetration testing methodology is a formal, repeatable game plan. It ensures that a test is thorough, safe for the client's environment, and produces clear, actionable results that demonstrate real business risk.
Think of it as the difference between randomly checking if doors are unlocked versus systematically casing a building, identifying all entry points, planning an approach, executing it, and then delivering a detailed architectural security report.
To understand the shift from unstructured hacking to professional, methodology-driven assessments, please read the introductory sections of the following article.
Penetration Testing Methodology 2025: Complete Guide
This article from DeepStrike, 'Penetration Testing Methodology 2025: Complete Guide', clearly explains what a real pentesting methodology is and why it's a critical component of any professional engagement.
Please read the sections 'Penetration Testing Methodology' and 'Beyond the Checklist: What is a Real Pentesting Methodology?'. Focus on why a structured approach is necessary and how it differs from a simple checklist or scan.
As the article highlights, methodologies bring order and predictability to the field, which is essential when millions of dollars are at stake. While several standard methodologies exist (like NIST SP 800-115, OSSTMM, and OWASP WSTG), we will focus on one of the most practical and widely recognized: the Penetration Testing Execution Standard (PTES).
2. The Phases of the Penetration Testing Execution Standard (PTES)
PTES was created by penetration testers, for penetration testers. It provides a clear, seven-phase workflow that mirrors how real-world attacks unfold. It’s an excellent foundation for understanding the entire lifecycle of a penetration test.
Here is a high-level visual overview of the seven phases:
Now, let's walk through a similar, generalized methodology that aligns closely with PTES. The following video by Instructor Alton provides a great, practical overview of the entire process. As you watch, notice how each phase logically follows the last.
Penetration Testing Methodology | Ethical Hacking for Beginners
This video, 'Penetration Testing Methodology | Ethical Hacking for Beginners', provides a fantastic high-level overview of a typical engagement. We will watch it in segments corresponding to the core phases.
Watch the video from the beginning to 08:49. We will break it down: Pre-Engagement (01:51 - 03:44): This is the crucial planning phase. Pay attention to the discussion of scope, rules of engagement (RoE), and different test types (white, grey, black box). Information Gathering & Scanning (03:44 - 05:14): This covers both passive reconnaissance (OSINT) and active scanning (like using Nmap). This maps to the PTES 'Intelligence Gathering' and part of the 'Vulnerability Analysis' phases. Vulnerability Assessment & Exploitation (05:14 - 06:34): This is where you identify and then actively try to exploit weaknesses. Note the cyclical nature mentioned—if an exploit fails, you go back to find another. Post-Exploitation (06:34 - 07:38): This is the critical 'So what?' phase. Once you're in, what can you do? Notice the focus on privilege escalation and lateral movement, which connects back to our last lesson on exploiting SUID permissions. Reporting (07:38 - 08:49): The final, and arguably most important, phase. This is the deliverable that provides value to the client.
3. A Deeper Dive into the Phases and Steps
You now have a solid high-level understanding of the flow. To add more detail, we'll turn to an article that not only describes the phases but also breaks down the specific steps within each one. This provides a more granular, real-world perspective on the activities a pentester performs.
Penetration Testing: Phases, Steps, Timeline & AI Streamlining
This article from Strikegraph, 'Penetration Testing: Phases, Steps, Timeline & AI Streamlining', gives an excellent breakdown of the individual steps within each phase of a pentest.
Read the following sections to get a detailed view of the key activities: Start with the 'Penetration testing phases' section for a quick summary of the overall flow. Then, read the detailed breakdowns in these sections: 'Steps in pre-engagement': Note the focus on legal documents and defining scope. 'Steps in the reconnaissance phase': See how OSINT and active gathering work in practice. 'Steps in the exploitation stage': Understand how testers prepare and execute exploits to demonstrate risk. 'Steps in the reporting phase': Notice the different components of a good report, including the executive summary and technical details.
The key takeaway is that each phase involves specific tasks, tools, and objectives. The reconnaissance phase is where you'll use tools like nmap and OSINT techniques. The exploitation and post-exploitation phases are where you'll leverage skills like command injection or exploiting weak file permissions. And it all culminates in a professional report that justifies the entire engagement.
Test your understanding!
Imagine you are on a penetration test. Match the following activities to the most appropriate PTES phase:
- Running
nmap -sV -p- 10.10.1.5to find all open ports and services on a target server. - Signing a Non-Disclosure Agreement (NDA) with the client.
- Using a known exploit for an outdated web server to gain a shell on the system.
- Writing a non-technical summary of your findings for the company's CEO.
- Searching for SUID binaries owned by
rootafter gaining initial access.
Show answer
- Vulnerability Analysis / Intelligence Gathering: This is active reconnaissance to identify potential attack vectors.
- Pre-Engagement Interactions: All contracts, scoping, and legal agreements happen before any testing begins.
- Exploitation: This is the act of actively using a vulnerability to gain access.
- Reporting: The executive summary is a key component of the final report.
- Post-Exploitation: This is a classic privilege escalation technique performed after you have already gained an initial foothold on the system.
Conclusion
Great work today. We've moved from the granular details of individual commands to the strategic framework that governs a professional penetration test. Having this mental map is essential for your development as an ethical hacker.
Key Takeaways:
- A penetration testing methodology is a structured, repeatable plan that ensures a professional and effective engagement.
- The Penetration Testing Execution Standard (PTES) is a common, practitioner-focused methodology with seven phases.
- The seven phases are: Pre-Engagement, Intelligence Gathering, Threat Modeling, Vulnerability Analysis, Exploitation, Post-Exploitation, and Reporting.
- Every technical skill you learn, from scanning to exploiting, fits within one of these phases.
This lesson completes our overview of the core tenets of penetration testing. In our next lesson, we will dive deeper into a critical part of the pre-engagement phase: explaining the legal and ethical boundaries of professional penetration testing. Understanding the rules of the road isn't just important—it's what keeps you out of jail and makes you a trusted professional.