Penetration Test Engagement Methodology

Work through a structured, repeatable methodology for authorized penetration tests.

When to Use

• You are planning or executing a penetration test with written authorization
• You need to ensure coverage and consistency across an engagement
• You are preparing deliverables for a client or internal stakeholder

Hard Rules

1. Never test without written authorization. Verify the scope statement, rules of engagement (RoE), and emergency contacts before touching anything.
2. Stay in scope. Check every IP, domain, and URL against the scope document before testing. If unsure, ask — do not guess.
3. No destructive actions unless explicitly authorized: no DoS, no data destruction, no production brute-force lockouts.

Phases

1. Scoping and Planning

• Capture in-scope assets, out-of-scope assets, testing windows, and escalation paths
• Identify the engagement type: black/grey/white box
• Agree on evidence-handling and data-destruction requirements
• Prepare the test plan and get sign-off

2. Reconnaissance

• Passive first: certificate transparency, DNS records, public code, job postings
• Active second: port scanning, service fingerprinting, subdomain enumeration
• Build an asset inventory with owner notes and observed technologies

3. Vulnerability Analysis

• Map the attack surface to likely vulnerability classes per technology
• Manual verification of every finding — scanners produce noise; you produce evidence
• Rank candidate findings by exploitability and business impact

4. Exploitation

• Use the least invasive proof that proves the finding (POC > payload)
• Document: request, response, tool, version, and timestamp for every exploit attempt
• Stop and escalate to the client if you reach a critical system boundary

5. Post-Exploitation

• Demonstrate impact: what data or access the foothold yields
• Attempt privilege escalation and lateral movement only within RoE
• Clean up: remove shells, scripts, and artifacts; record what was created where

6. Reporting

• Executive summary: business risk in plain language
• Findings: title, severity (CVSS), affected assets, reproduction steps, evidence, remediation advice
• Retest criteria and positive observations

Output Format

Deliver: test plan, asset inventory, findings report with evidence, cleanup log, and a debrief agenda.