Penetration Testing Phases: Recon to Reporting

A structured penetration test follows a defined lifecycle that ensures thorough coverage, minimizes risk to production systems, and produces actionable results. The most widely adopted framework comes from the PTES (Penetration Testing Execution Standard) and aligns with the NIST approach. The phases are: Planning/Scoping, Reconnaissance, Scanning, Exploitation, Post-Exploitation, and Reporting. Each phase builds on the previous — you cannot exploit what you haven't discovered, and you cannot report what you haven't documented. Skipping or rushing phases leads to incomplete assessments and unreliable findings.

The planning phase establishes the legal and operational foundation for the engagement. Key deliverables include: a signed Statement of Work (SOW) defining objectives and pricing; a Rules of Engagement (RoE) document specifying authorized targets, time windows, prohibited techniques, emergency contacts, and data handling requirements; and clear definition of success criteria (what constitutes achieving the objective). The scope must be precisely defined to prevent scope creep (accidentally testing unauthorized systems) and to ensure the assessment covers the most critical assets. All communication channels and escalation procedures are established before any technical work begins.

Passive reconnaissance collects information about the target without directly interacting with their systems — using public sources that do not generate logs on the target. Sources include: WHOIS records (domain registration, registrant contact), DNS records, certificate transparency logs (revealing subdomains), LinkedIn (employee names, job titles, technologies used), job postings (reveal tech stack and tools), Shodan/Censys (internet-facing services and open ports), GitHub repositories (source code, credentials accidentally committed), and Google dorking (site-specific searches for sensitive files and exposed interfaces).

Active reconnaissance involves directly interacting with target systems to gather information. This generates logs on the target and is inherently noisier than passive recon. Techniques include port scanning (Nmap), service enumeration, DNS zone transfer attempts, and banner grabbing. The boundary between reconnaissance and scanning is blurry — the goal of reconnaissance is information gathering while scanning typically implies vulnerability identification. However, active recon can trigger IDS/IPS alerts and may be detected by a security-aware target, so testers balance thoroughness with stealth based on the engagement objective (test detection vs. stealth compromise).

The scanning phase systematically discovers open ports, services, software versions, and known vulnerabilities on in-scope targets. This phase uses tools like Nmap for service enumeration and Nessus/OpenVAS for vulnerability scanning. The pen tester manually reviews scanner output and correlates findings: a version of Apache identified by Nmap may match known exploits in the CVE database. This phase also includes manually probing web applications (with Burp Suite) and testing authentication mechanisms. The output is a prioritized list of potential attack paths to pursue in the exploitation phase.

The exploitation phase attempts to leverage identified vulnerabilities to achieve unauthorized access, privilege escalation, or other defined objectives. Exploitation must stay strictly within scope and the Rules of Engagement. Techniques include exploiting unpatched vulnerabilities (using Metasploit or manual exploits), credential attacks (password spraying, default credentials, brute-forcing), web application attacks (SQL injection, XSS exploitation), and social engineering if authorized. Every action must be documented with timestamps: what was done, when, what the result was, and what tool was used. This documentation forms the evidence base for the final report.

Post-exploitation begins after initial access is achieved and explores how far an attacker could extend their reach. Activities include: privilege escalation (gaining admin/root from limited user access), credential harvesting (extracting hashes, tickets, or plaintext passwords), lateral movement (accessing other systems using harvested credentials), data discovery (identifying sensitive data accessible from the compromised position), and establishing persistence (to simulate APT long-term access). The goal is to show the realistic impact of the initial compromise — not just that one system was pwned, but what the attacker could ultimately reach.

Pivoting uses a compromised host as a relay to reach network segments that are otherwise inaccessible to the pen tester (e.g., an internal database VLAN only reachable from the application server). Metasploit's route add command and SSH tunneling (ssh -L for local forwarding or ssh -D for SOCKS proxy) are common pivot mechanisms. Pivoting demonstrates whether network segmentation is truly effective — a well-segmented network should prevent a compromised DMZ server from reaching internal databases, while a flat network allows free lateral movement. Documented pivot paths in the report show exactly where segmentation gaps exist.

After testing is complete, pen testers must clean up — removing backdoors, accounts, and tools they installed. Unlike real attackers, pen testers are obligated by the Rules of Engagement to restore systems to their pre-test state. Cleanup items include: removing created user accounts, deleting dropped files (payloads, tools), removing persistence mechanisms (WMI subscriptions, scheduled tasks, registry run keys), and confirming with the client that all test artifacts are gone. Evidence preservation runs in parallel: retain all screenshots, tool output, logs, and notes in a secure format for report writing and potential legal reference.

The report is the ultimate deliverable that justifies the engagement and drives remediation. A well-structured report includes: an executive summary (risk rating, business impact, top 3 findings for leadership); a technical findings section (each finding with severity, description, evidence, reproduction steps, business impact, and specific remediation guidance); and an appendix with raw tool output and detailed timelines. Reports are classified as confidential — they contain enough detail to repeat the attack. Delivery typically involves a debrief meeting where the pen test team walks through findings and answers client questions. Good reporting is what separates professional engagements from amateur scan dumps.

Security+ frequently tests the distinction between passive and active reconnaissance. Passive recon involves gathering information from public sources without directly contacting target systems — no logs are created on the target. Examples: reading WHOIS records, reviewing LinkedIn, querying certificate transparency logs, running Shodan searches. Active recon involves directly interacting with target systems — port scanning, banner grabbing, DNS zone transfer attempts. Active recon generates logs and may trigger IDS alerts. In a real engagement, passive recon precedes active to build a map before making any detectable contact with the target network.

Test your understanding of CompTIA Security+ (SY0-701) concepts from this lesson.

In this lesson you learned: penetration testing follows a structured lifecycle of planning, reconnaissance, scanning, exploitation, post-exploitation, and reporting, passive reconnaissance uses public OSINT sources without creating target-side logs while active recon directly interacts with systems, and the final report with its executive summary, technical findings, and specific remediation guidance is the key deliverable that drives security improvements. Next up we explore CVSS scoring and how to prioritize vulnerability remediation.