Penetration testing (pen test for short) is an ethical hacking technique in which an attack is officially simulated against a company’s technical infrastructure to know about all the security loopholes a threat actor can exploit. In simpler words, a white-hat hacker tries breaking into different domains of a company’s technical system to come across all the gateways through which a cybercriminal can also break in and wreak havoc.

The common domains are-

• Network security
• Web applications and APIs
• Cloud infrastructure
• Operating systems and endpoints
• Wireless and IoT security
• Social engineering and human factor
• Databases and storage security
• DevOps & CI/CD pipelines

A pen test follows a structured methodology that unfolds into five stages. These stages help a pen tester systematically assess security vulnerabilities and ensure a comprehensive evaluation of technical infrastructure.

This blog discusses what is done in each stage and why every stage matters.

Stage 1- Planning and reconnaissance (information gathering)

Planning and reconnaissance is the foremost stage in which the pen tester gathers information about the system, network, or organization before planning a simulated attack. This step helps them understand the attack surface, identify potential weak points, and devise the right approach for the upcoming stages.

This stage helps focus on exploitable security loopholes so that a pen tester doesn’t have to wait for the time and resources to find random gateways and attacks. It basically creates a base for how the entire pen test would unfold. If reconnaissance is weak, exploitation may fail, or the white-hat hacker may miss critical vulnerabilities. Without this step, it’s like shooting in the dark.

Reconnaissance is divided into two types-

• Passive reconnaissance– This includes gathering information without any direct interaction with the technical system.
• Active reconnaissance– This includes actively probing the system for important information that helps generate logs and alerts.

How is planning and reconnaissance conducted?

So, before anything is done, the pen tester and the client (organization) discuss the scope, which generally includes-

• The assets to be tested (like web applications, IP addresses, subdomains, APIs, cloud infrastructure, etc.).
• Testing type (black-box, gray-box, or white-box).
• Legal authorization (avoid unauthorized testings that may violate laws).
• Rules of engagement (what can and can’t be tested).

What is expected from the reconnaissance phase?

After completing reconnaissance, a pentester should have the following:

• A list of subdomains, IP addresses, and exposed assets.
• Identified open ports and running services.
• Detailed information on the technologies used.
• Potential entry points such as outdated software or leaked credentials.
• Insights for social engineering (employee details, internal tools, email formats).

The gathered intelligence helps in the next phase to focus on high-risk vulnerabilities.

Stage 2- Scanning and enumeration

In the second phase of penetration testing, the white-hat hacker interacts with the targeted system so as to come across all the open ports, running services, network topology, and system details. This gives them a deeper understanding of the potential attack vectors so that they can lay down the groundwork for exploitation in the next phase.

How is scanning and enumeration conducted?

Firstly, scanning is done. This involves locating open ports, services, and network topology using various scanning techniques.

Next comes the enumeration part, in which usernames, network shares, exposed directories, and service details are extracted from the systems discovered.

What is expected from the scanning and enumeration phase?

Once the second phase is completed, a pen tester should have the following-

• List of open ports and running services.
• Service versions (to check for known vulnerabilities).
• Exposed directories, API endpoints, and admin panels.
• Usernames, shared folders, and weak credentials.
• Potential exploitation paths for the next phase.

This phase directly influences the success of exploitation in the next stage. Basically, what it does is help create a blueprint for the attack.

Stage 3- Exploitation (gaining access)

In the exploitation stage, the pen tester gets down to leveraging vulnerabilities to break into systems. This stage involves executing attacks using custom scripts, publicly known exploits, or zero-day vulnerabilities. They try to get their hands on critical data such as credentials, customer data, financial records, employee information, codes, etc. They escalate privileges to gain deeper access to the technical infrastructure and try to maintain a position in the system so that they continue getting access. This way, they test how efficient an organization’s cybersecurity defenses are.

How is exploitation conducted?

Depending on what all vulnerabilities have been discovered in the previous stages, the right set of techniques are used for exploiting the targeted systems. Firstly, the white-hat hacker searches for publicly available exploits in the exploit database. If they don’t spot any public exploits, they develop a custom exploit, which is executed against the targeted system. These exploits are usually put into effect through automated scripts or manual payload crafting.

Automated tools simplify exploitation by integrating pre-built payloads and exploit modules. These tools can rapidly test and execute known exploits without requiring deep customization. However, sometimes automated tools are inefficient or trigger security defenses, so pen testers manually craft an exploit. The manual ones are capable of bypassing security defenses like firewalls and Intrusion Detection Systems (IDS).

What is expected from the exploitation phase?

Once the exploit is loaded, the following outcomes can be expected-

• The pen tester can run arbitrary commands on the system.
• The pen tester gains unauthorized entry into a system.
• The pen tester escalates from a regular user to an administrator/root.
• The pen tester crashes or disrupts services on the target system.
• The pen tester extracts passwords, tokens, or cryptographic keys.

Stage 4- Post-exploitation and lateral movement

‘Post-exploitation and lateral movement’ refers to actions taken once the pen tester has broken into the targeted systems. It’s an important stage that determines the value of the compromised machine and explores ways through which privileges can be escalated. They basically try to move across the system and establish a backdoor to maintain access, just as a threat actor would do to keep exploiting systems and extracting sensitive information.

How is post-exploitation conducted?

After the pen tester is inside the targeted systems, their goal is to escalate privileges to admin or root access using techniques such as Kernel Exploits, Misconfigured services, credential dumping, and DLL hijacking.

Once they have escalated the privilege, their next goal is to establish a backdoor or configure the system in a way that they get future access. Next comes lateral movement, which means they try to get access to other machines within the network. After gaining deeper access, the pen tester starts searching for critical data that a threat actor would usually try to exfiltrate. This data is extracted without getting detected.

What is expected from the post-exploitation and lateral movement phase?

• The pen tester gains deep access across the enterprise.
• They extract important records, documents, codes, links, graphics, etc.
• They maintain an undetectable, stealthy access even after the initial test is done.
• They hop from one machine to another inside the network.

Stage 5- Reporting and remediation

This is the final and most crucial stage in which the pen tester is responsible for documenting the findings, evaluating risk levels, and recommending ways to fix the loopholes so threat actors can’t exploit them. The report includes precise remediation steps the company’s cybersecurity team should take to fill the gaps.

Once the security gaps are filled by following the recommended steps, a re-test is performed to assess whether the previously identified vulnerabilities are fixed and cannot be exploited again. This step is important because sometimes fixes are not done properly or fail to address the issue completely, leaving unguarded gateways for bad actors to walk in. Moreover, re-testing also ensures that patching has not introduced any new vulnerabilities to the system.

How is remediation conducted?

For remediation, the security team applies patches, improves configurations, and strengthens policies based on the report. Here are the common remediation actions that are suggested by pen testers in the report-

• Patch management: Update software and OS versions.
• Hardening systems: Disable SMBv1, enforce strong encryption, and remove unnecessary services.
• Enforcing strong authentication: Implement MFA, password policies, and session timeouts.
• Network segmentation: Restrict lateral movement using VLANs, firewalls, and Zero Trust policies.
• Continuous monitoring: Deploy SIEM (Security Information and Event Management) solutions.

What is expected from the reporting and remediation phase?

By the end of all the stages, the ethical hacker should have a detailed compilation of the findings, attack paths, and recommendations to fix the loopholes. As for the organization, they should have a clear understanding of how attacks work and improve defenses.

I hope you liked the blog. If you are looking for someone to write such comprehensive yet easy-to-digest cybersecurity content for your website or email campaigns, please reach out to me at daksh@turtlewords.com. I would love to collaborate with you on long-term freelance contracts.