Penetration Testing Methodologies
Penetration testing simulates real attacks to identify vulnerabilities before adversaries do. Effective testing follows structured methodologies that ensure comprehensive coverage while maintaining legal and ethical boundaries.
Penetration Testing Frameworks
Multiple methodologies guide penetration testing engagements. Each offers different perspectives and levels of detail for various testing scenarios.
PTES (Penetration Testing Execution Standard)
Comprehensive framework with pre-engagement through reporting phases.
Key Feature: Emphasis on pre-engagement communication and threat emulation.
OSSTMM (Open Source Security Testing Methodology Manual)
Scientific methodology focusing on measurable security metrics.
Key Feature: Quantifies security through the Security Tenacity Chain.
NIST SP 800-115
Government methodology covering technical testing approaches.
Key Feature: Integration with risk management and compliance requirements.
MITRE ATT&CK
Adversary TTP framework mapping real-world attack behaviors.
Key Feature: Maps defensive gaps to specific adversary techniques.
Penetration Testing Phases
The attack lifecycle mirrors real adversaries. Understanding each phase helps identify where defenses failed and how to improve them.
Reconnaissance
Passive information gathering without direct interaction with target.
WHOIS, DNS enumeration, social media research, public breach data.
theHarvester, Maltego, Shodan, Recon-ng
Scanning & Enumeration
Active probing to identify live systems, open ports, and services.
Port scanning, service detection, OS fingerprinting, vulnerability scanning.
Nmap, Nessus, Masscan, Nikto
Gaining Access
Exploiting identified vulnerabilities to gain initial system access.
Exploit execution, social engineering, credential attacks.
Metasploit, SQLMap, Burp Suite, Hydra
Maintaining Access
Ensuring persistent access to compromised systems.
Web shells, scheduled tasks, rootkits, backdoor installation.
Netcat, Empire, Metasploit persistence modules
Privilege Escalation
Increasing access level from user to administrator/root.
Kernel exploits, misconfigurations, password reuse, token impersonation.
LinPEAS, WinPEAS, PowerSploit, BeRoot
Lateral Movement
Expanding access to other systems in the network.
Pass-the-hash, SMB relay, remote desktop, remote PowerShell.
Mimikatz, CrackMapExec, BloodHound, PsExec
Penetration Testing Report Structure
Effective reports translate technical findings into actionable business recommendations. Poor reporting wastes testing investment and delays remediation.
Executive Summary
High-level findings, business impact, risk rating.
Technical Details
Vulnerability descriptions, affected systems, reproduction steps.
Proof of Concept
Demonstration of exploitability with evidence.
Remediation
Specific recommendations with priority ratings.
Retest Results
Verification that fixes were properly applied.
Legal & Ethical Considerations
Penetration testing requires explicit authorization. Without proper legal protections, legitimate security testing can result in criminal charges.
Key Takeaways
- PTES and OSSTMM provide structured approaches with defined phases.
- Reconnaissance→Exfiltration mirrors real adversary attack paths.
- MITRE ATT&CK maps testing to real-world adversary techniques.
- Written authorization is mandatory—verbal permission is insufficient.