By N. Craig

Introduction to Penetration Testing

What Is Penetration Testing?

Penetration testing also called pen testing or ethical hacking is the authorized, simulated attack on a computer system, network, web application, or physical environment performed by security professionals to identify security vulnerabilities that real attackers could exploit. Unlike vulnerability scanning — which only identifies potential weaknesses — penetration testing actively exploits them to demonstrate real-world impact and business risk.

Penetration Testing vs. Vulnerability Assessment vs. Red Team

Why Penetration Testing Is Essential

Organizations invest heavily in security controls — firewalls, EDR, IAM, patching programs — but these controls are only effective if they function correctly against real adversary techniques. Penetration testing answers questions that no other security activity can:

• Can an external attacker gain initial access to our network?
• If a credential is compromised, how far can an attacker move laterally?
• Can our security monitoring detect and respond to a real attack in progress?
• Are our most critical assets (financial systems, customer data, intellectual property) actually protected?
• Does our patching program eliminate vulnerabilities before attackers can exploit them?
• Would a social engineering attack succeed against our trained workforce?

Core Terminology

Classifying Penetration Tests

Knowledge Level Classifications

Penetration tests are categorized by how much information the tester is given about the target environment before testing begins. Each model has specific advantages and is appropriate for different testing objectives:

Testing Domain Classifications

Selecting the Right Test

Pre-Engagement Phase

The pre-engagement phase establishes the legal, procedural, and logistical foundation for the entire penetration test. Failures in pre-engagement — unclear scope, missing authorizations, undefined emergency contacts — are the leading cause of incidents, legal exposure, and failed tests. This phase requires as much rigor as the technical testing itself.

Engagement Documentation Requirements

No testing activity may begin without ALL of the following documents reviewed, negotiated, and signed by authorized parties on both sides:

Scoping Methodology

Scope definition is the most consequential pre-engagement decision. Scope that is too narrow produces incomplete findings; scope that is too broad produces unfocused results and cost overruns.

Network & Infrastructure Scoping

• Define all IP ranges, CIDR blocks, and hostnames explicitly in scope — ambiguity creates legal risk
• Identify explicitly out-of-scope systems (third-party hosting, shared environments, DR systems, production databases with real PII)
• Specify whether cloud accounts, sub-domains, and acquired company infrastructure are in scope
• Identify third-party systems that may be touched (CDNs, WAFs, DDoS protection services) — these require third-party authorization
• Document whether Denial of Service testing is authorized — this must be explicit, not assumed

Application Scoping

• List all application URLs, APIs, and mobile apps in scope with their environments (production vs. staging)
• Specify whether testing on production data is authorized or whether a sanitized test environment is required
• Define authenticated testing roles: which user roles will testers operate as?
• Identify rate-limited or business-critical transaction flows where testing intensity must be limited

Social Engineering Scoping

• Define allowed social engineering techniques: phishing email only, vishing calls, physical access testing
• Specify whether employees are aware a test is happening (announced vs. unannounced)
• Define what counts as a ‘success’ — clicking a link, submitting credentials, granting physical access
• Establish procedures for staff who report the test — they should not be told it is a test until after campaign close

Rules of Engagement (ROE) — Key Clauses

Testing Methodology Overview

The penetration testing methodology follows a structured, repeatable lifecycle. While the specific techniques vary by target domain, the logical flow is consistent across all test types.

Reconnaissance

Reconnaissance is the intelligence-gathering phase. The goal is to build the most complete picture of the target’s attack surface using only publicly available information and authorized scanning — before touching a single target system. A well-executed reconnaissance phase directly determines the quality and efficiency of everything that follows.

Passive Reconnaissance (OSINT)

Passive reconnaissance gathers information without any direct interaction with the target’s systems. Because it uses only publicly available data, it carries zero technical risk to the tester and produces no evidence of testing activity in the target’s logs.

OSINT Techniques & Sources

Active Reconnaissance

Active reconnaissance involves direct interaction with target systems. While it generates log entries on the target, it remains in the reconnaissance phase because no exploitation attempts are made. Active recon must stay within authorized scope.

• DNS brute-forcing and zone transfers — attempt to enumerate all subdomains and records from DNS servers
• Web spidering / crawling — automated discovery of application pages, endpoints, and parameters
• Directory and file fuzzing — enumerate hidden directories, backup files, and administrative interfaces using wordlists
• Banner grabbing — connect to services to retrieve version information from banners (HTTP headers, SSH banners, SMTP EHLO)
• Email harvesting with validation — verify discovered email addresses are active via SMTP enumeration
• WAF/IDS fingerprinting — identify security controls in place to inform evasion planning

Reconnaissance Deliverables

Before proceeding to scanning, document all reconnaissance findings in a structured format. The reconnaissance report serves as the test’s intelligence brief and attack map:

• Domain InventoryAll confirmed domains, subdomains, and IP ranges owned by the target
• Technology InventoryIdentified frameworks, server software, security controls, cloud providers
• Employee DataKey personnel with security responsibilities, email format, technology expertise visible in public sources
• Exposed Sensitive DataAPI keys, credentials, internal URLs, or architecture details found in public sources — critical findings, report immediately
• Attack Surface SummaryPrioritized list of high-value entry points identified for scanning and exploitation phases

Scanning & Enumeration

Scanning builds on reconnaissance by actively probing target systems to map open services, identify software versions, and enumerate configuration details. Together, scanning and enumeration generate the technical evidence base for vulnerability analysis.

Network Scanning

Host Discovery

Before port scanning, confirm which hosts are alive to avoid wasting time on non-existent targets:

• ICMP ping sweep — fastest method; often blocked by firewalls on hardened networks
• TCP SYN ping (port 80/443) — more reliable through firewalls; sends SYN, looks for SYN-ACK
• ARP scan — most reliable on local subnets; cannot cross routers
• UDP ping — useful when ICMP and TCP are filtered

Port Scanning Techniques

Service Enumeration

Once open ports and services are identified, enumerate each service in detail to extract actionable intelligence:

Active Directory Enumeration

Active Directory is the primary identity infrastructure in most enterprise environments and is a critical target in any internal penetration test. Thorough AD enumeration often reveals the complete path from initial access to domain dominance:

• Domain ControllersIdentify all DCs, their OS versions, and FSMO roles
• User EnumerationFull user list, privileged account identification, service accounts, stale accounts, password policy (minimum length, lockout threshold, complexity requirements)
• Group EnumerationDomain Admins, Enterprise Admins, Server Operators, Backup Operators — who has privileged access?
• Trust RelationshipsDomain trusts and their directions — can compromise of a child domain lead to parent domain compromise?
• Group Policy ObjectsIdentify GPOs that push scripts, configure security settings, or deploy software — potential misuse for lateral movement
• Kerberos ConfigurationIdentify Service Principal Names (SPNs) for Kerberoasting; identify AS-REP Roastable accounts (no pre-authentication required)
• ACL AnalysisIdentify over-permissive Access Control Lists — especially write/GenericAll permissions on sensitive objects (BloodHound excels at this)

Vulnerability Analysis & Exploitation

Vulnerability Analysis

Vulnerability analysis correlates enumeration data with known vulnerability databases to identify which discovered services, versions, and configurations have exploitable weaknesses. This phase produces the prioritized target list for exploitation.

• Cross-reference discovered software versions against CVE databases (NVD, Exploit-DB, Vulners) for known vulnerabilities
• Run automated vulnerability scanners (Nessus, OpenVAS, Nexpose) to identify known vulnerabilities at scale — validate all critical findings manually
• Analyze service configurations for security weaknesses: default credentials, weak cipher suites, missing patches, insecure protocols
• Review web application structure for OWASP Top 10 vulnerabilities through manual analysis and automated tools
• Prioritize findings using CVSS score PLUS exploitability context: is there a public exploit? Does it require authentication? Is the attack surface network-accessible?
• Document each finding with: CVE reference (if applicable), affected component, evidence of existence, CVSS score, and exploitation hypothesis

OWASP Top 10 — Web Application Vulnerability Reference

Exploitation

Exploitation is the phase where identified vulnerabilities are actively leveraged to gain unauthorized access. In a penetration test, exploitation serves to confirm that a vulnerability is genuinely exploitable and to demonstrate the real business impact of that exploitation.

Network Exploitation Techniques

Common Exploitation Frameworks

Post-Exploitation

Post-exploitation answers the most important question in a penetration test: what could an attacker do after gaining initial access? A single foothold on a low-privilege workstation may appear minor — but post-exploitation activities frequently reveal that an attacker could reach Domain Admin, exfiltrate sensitive data, or achieve complete business disruption.

Privilege Escalation

After initial access, the tester works to elevate privileges to maximize the impact they can demonstrate.

Windows Privilege Escalation

Linux Privilege Escalation

• SUID/SGID binaries — executables running as root regardless of calling user; GTFOBins database of exploitable binaries
• Writable /etc/passwd or /etc/shadow — direct password modification or hash extraction
• Sudo misconfigurations — sudo -l reveals commands executable as root without password; GTFOBins exploitation
• Cron job exploitation — world-writable scripts executed by cron as root
• Kernel exploits — dirty pipe (CVE-2022-0847), dirty cow (CVE-2016-5195), overlayfs escalations
• Credentials in config files, environment variables, .bash_history, and application configuration

Lateral Movement Techniques

Lateral movement expands the tester’s footprint across the network to demonstrate the full scope of attacker access and the value of assets that could be compromised:

Credential Harvesting

• LSASS Memory Dumping — Mimikatz, ProcDump + Mimikatz offline: extracts plaintext passwords, NTLM hashes, and Kerberos tickets from Windows LSASS process
• NTDS.dit Extraction — database of all domain account hashes; extractable via VSS shadow copy, ntdsutil, or DCSync attack
• SAM Database — local Windows account hashes; accessible as SYSTEM via registry export or VSS
• Kerberoasting — request TGS tickets for service accounts (SPNs); extract ticket from memory; crack offline with hashcat
• AS-REP Roasting — accounts with Kerberos pre-auth disabled; request AS-REP without credentials; crack offline
• DPAPI Master Key Extraction — decrypt Chrome/Edge saved passwords, certificate private keys, other DPAPI-protected secrets
• Credential Files — searching file system, shares, and databases for credentials in plaintext: config files, scripts, password managers, email attachments

Demonstrating Crown Jewel Access

The culmination of post-exploitation is demonstrating access to the organization’s most critical assets — the ‘crown jewels’ defined during pre-engagement scoping:

Penetration Test Reporting

The penetration test report is the primary deliverable — the document that transforms technical findings into actionable security improvement. A poor technical test with an excellent report is more valuable than an excellent test with a poor report. Findings must be written for multiple audiences: technical teams who will remediate, and executives who must understand business risk and prioritize investment.

Report Structure

Finding Template — Required Fields

Severity Rating Framework

Writing for Multiple Audiences

Specialized Assessment Domains

Cloud Penetration Testing

Cloud environments introduce attack surfaces fundamentally different from on-premises infrastructure. Misconfiguration — not software vulnerabilities — is the dominant risk vector in cloud environments. Cloud penetration testing requires specific expertise in cloud-native IAM, service configurations, and shared responsibility model implications.

Cloud-Specific Attack Techniques

Social Engineering Assessment

Social engineering tests the human layer of security — often the most exploitable attack surface in any organization. These assessments require careful ethical handling, explicit scope definition, and careful management of employee welfare throughout.

Phishing Campaign Methodology

• Define campaign objectives and success criteria (click rate, credential submission rate, MFA bypass rate)
• Profile target users: seniority, department, role-appropriate pretexts (IT helpdesk, HR, finance themes)
• Design phishing infrastructure: domain registration (typosquatting, look-alike domain), email template, credential harvesting page
• Validate deliverability: test against spam filters, DMARC/SPF/DKIM alignment; adjust as needed
• Execute phishing campaign within authorized window; track clicks, submissions, and reports
• Debrief: inform recipients that the email was a test; provide immediate security awareness training
• Report: campaign metrics; who clicked, who submitted credentials, who reported; by department breakdown

Physical Penetration Testing

Physical penetration testing assesses the organization’s physical security controls — access control systems, security staff responses, surveillance coverage, and physical security policies.

• Tailgating / PiggybackingFollowing authorized personnel through secure access points; tests staff compliance with badge policy
• Social Engineering / PretextingImpersonating IT support, delivery personnel, or new employees to gain facility access
• RFID CloningCapturing and cloning proximity card credentials using a Proxmark or similar device
• Lock Picking / BypassTesting physical lock quality; using bypass tools on lever-handle locks, padlocks, or electric strikes
• Dumpster DivingExamining discarded materials for sensitive information: old hardware, documents, access badges, printed credentials
• USB Drop TestPlacing labeled USB drives in facility; tracking how many are plugged into corporate systems and reported

Legal & Ethical Framework

Legal Authorization Framework

Penetration testing without proper authorization violates computer crime laws in virtually every jurisdiction. Understanding the legal framework is a professional and ethical obligation for every practitioner:

Professional Ethics Standards

• Scope AdherenceTest only what is explicitly authorized — no exceptions, no ‘while we’re here’ additions
• Minimal FootprintUse the least invasive technique that demonstrates the finding; avoid unnecessary system impact
• ConfidentialityTreat all client information as strictly confidential; proper NDA required before engagement initiation
• Responsible DisclosureIf a previously unknown vulnerability is discovered, follow responsible disclosure practices — notify vendor before public disclosure
• No Personal BenefitNever use access obtained during an engagement for any purpose beyond the engagement objectives
• Client ProtectionIf a real attacker is discovered during testing, immediately notify the client — do not proceed with authorized testing while real attacker is active
• Data MinimizationCollect only the minimum evidence necessary to demonstrate exploitation; never exfiltrate or retain client data beyond engagement period
• Truthful ReportingReport all findings accurately — do not exaggerate or minimize findings for commercial or relationship reasons

Professional Certifications

Quick Reference — Penetration Testing Key Terms

Appendix A: Pre-Engagement Checklist

Complete all items before any testing activity begins. No exceptions — each item represents a legal, ethical, or operational requirement.

Appendix B: Tools Quick Reference

Appendix C: Recommended Resources

• PTES (Penetration Testing Execution Standard) — pentest-standard.org — comprehensive methodology reference
• OWASP Testing Guide v4.2 — owasp.org/www-project-web-security-testing-guide
• NIST SP 800-115 — Technical Guide to Information Security Testing and Assessment
• MITRE ATT&CK Framework — attack.mitre.org — adversary TTP knowledge base; essential for reporting and red teaming
• Exploit-DB — exploit-db.com — searchable database of public exploits and shellcode
• PayloadsAllTheThings — github.com/swisskyrepo/PayloadsAllTheThings — payload collection for every vulnerability class
• HackTricks — book.hacktricks.xyz — comprehensive pentesting techniques and checklists
• TryHackMe / HackTheBox — online lab platforms for hands-on penetration testing practice
• GTFOBins — gtfobins.github.io — Unix binaries exploitable for privilege escalation and bypass
• LOLBAS — lolbas-project.github.io — Living Off the Land Binaries and Scripts for Windows