Professional penetration testing is not improvised — it follows proven methodologies. The best-known framework is the Penetration Testing Execution Standard (PTES), which divides an engagement into seven phases. Understanding this workflow separates professionals from amateurs.
Phase 1: Pre-Engagement & Scoping
Before anything technical happens, everything is agreed in writing:
- Scope: exactly which systems, IPs, URLs, and time windows are in bounds.
- Rules of engagement: what techniques are allowed (is social engineering permitted? denial-of-service?) and emergency contacts.
- Legal authorization: a signed contract. This single document is what separates a professional test from a crime.
Phase 2: Intelligence Gathering (Reconnaissance)
Collecting information about the target organization — using only public sources and the agreed methods. This includes the organization's own websites, public records, DNS information, and job postings (which often reveal technologies in use). Passive reconnaissance never touches the target's systems directly.
Phase 3: Threat Modeling
Analyzing the gathered intelligence to identify the most valuable targets and likely attack paths — the crown jewels (customer databases, payment systems) and how an attacker would plausibly reach them. This focuses the test where it matters most.
Phase 4: Vulnerability Analysis
Systematically identifying weaknesses in the agreed scope: scanning the organization's own systems for open ports and services, checking software versions against known vulnerability databases, and reviewing configurations. The output is a prioritized list of potential issues to verify.
Phase 5: Exploitation (Controlled Proof)
Carefully demonstrating that a vulnerability is real — for example, showing that a test account can access data it should not — while staying strictly within scope and stopping before any harm. The goal is proof, not damage: screenshots and logs that prove impact, then immediate halt. Anything risking real damage is documented as a finding instead of exploited.
Phase 6: Post-Exploitation
Determining what an attacker could do after an initial foothold — within the agreed limits. In professional practice this is tightly controlled and often simulated or table-topped rather than fully executed, since the point (the vulnerability is real and serious) is already proven.
Phase 7: Reporting — The Real Deliverable
A penetration test's value lives in its report. A professional report includes:
- Executive summary — risk in business language for leadership.
- Findings — each with severity rating, evidence, affected systems, and business impact.
- Remediation guidance — specific, actionable fix instructions prioritized by risk.
- Positive findings — defenses that worked well (important for morale and budgets).
Other Frameworks Worth Knowing
- OWASP Testing Guide — the standard for web application testing.
- NIST SP 800-115 — the US government's technical guide to security testing.
- OSSTMM — a scientific methodology for operational security metrics.
Practicing Legally
You can learn every phase hands-on without ever touching a real target: build your own lab with virtual machines, use intentionally vulnerable training applications (like OWASP Juice Shop or DVWA) on your own computer, and join authorized platforms like HackTheBox, TryHackMe, or bug bounty programs that explicitly invite testing. See our Kali Linux setup guide to build your lab.
Methodology in Practice: A Walkthrough Mindset
Imagine you are authorized to test a small company's website. Methodology keeps you disciplined: in recon you map what exists (subdomains, technologies) without touching anything sensitive; in scanning you enumerate the agreed targets systematically rather than poking randomly; in exploitation you prove one clear issue with minimal impact and stop; in reporting you explain it so a non-technical owner understands the risk and the fix. Amateurs chase excitement; professionals produce evidence and remediation. That discipline is what clients pay for.
Common Beginner Mistakes
- Skipping scoping: testing anything "interesting" outside the agreement — the fastest way to turn legal work into a crime.
- No notes: failing to document steps, then being unable to reproduce or evidence findings.
- Tool-first thinking: running scanners without understanding what they do or what the output means.
- Weak reports: technical dumps with no severity ratings or fix guidance — useless to the client.
- Scope creep excitement: finding something cool out-of-scope and "just taking a peek." Never.
Checklists Professionals Use
Before engagement: signed authorization? Emergency contacts? Backup/rollback plan? Test window confirmed? During: notes timestamped? Screenshots captured? Staying in scope? After: report reviewed? Findings prioritized? Retest scheduled? Methodology is, at its core, checklists plus judgment — boring, repeatable, and effective.
Adapting Methodology to Scope
Not every engagement needs all seven PTES phases at full depth. A small business website test might compress recon and threat modeling into a day; a bank's annual assessment runs every phase rigorously for weeks. The methodology is a framework, not a cage — professionals scale effort to risk, always keeping the core disciplines: written scope, systematic coverage, evidenced findings, and clear reporting. What never gets skipped: authorization, documentation, and the report.
Tools Mapped to Phases (Your Lab)
- Recon: search engines, DNS tools, and your own notes — all passive against public sources.
- Scanning: Nmap on your own lab network (see our Nmap guide).
- Vulnerability analysis: version research against public databases for your lab VMs.
- Exploitation: Metasploit check and controlled modules against your own vulnerable VMs (see our Metasploit guide).
- Reporting: your lab journal, formatted as a professional finding.
Practicing each phase with its proper tool, in your own environment, builds the muscle memory professionals rely on.