Penetration testing execution and exploitation techniques
Penetration testing execution and exploitation techniques
This domain tests your discipline under pressure: turning a validated vulnerability into demonstrated impact while staying inside scope, avoiding damage, and producing proof that survives scrutiny.
Core rules and concepts
- Pre-exploitation checks: confirm the target resolves to an in-scope asset, confirm the change window, and know the stop condition and rollback plan before sending a payload.
- Least-impact exploitation. Prefer read-only proof: version strings, current user, a single row, a file listing. Avoid destructive commands, bulk data extraction and anything that modifies business records.
- Post-exploitation is scoped too. Privilege escalation, credential access, lateral movement and pivoting are only authorised against in-scope hosts. Pivoting through a client host into a third-party network is out of bounds unless explicitly agreed.
- Capture proof properly. Record hostname, user context, IP configuration, timestamps and the command that produced the output. Screenshots should show the system clock and the address bar or terminal prompt.
- Coordinate and clean up. Deconflict with the blue team where the RoE allows, and remove uploaded files, created accounts, scheduled tasks and configuration changes at the end.
Worked example
You confirm SQL injection in a login form. Reasoning: the objective is to prove impact, not to exfiltrate the customer database. Instead of dumping the users table, issue database version and current user queries, then a count of rows in the users table and a single redacted record to prove access. This demonstrates the vulnerability and its blast radius, keeps personal data handling to a minimum, and gives the client a clean evidence trail without turning the test into a data breach.
Traps that cost marks
- Running destructive payloads such as DROP or mass updates on production.
- Pivoting to a host that was not in the agreed scope.
- Leaving web shells, test accounts or scheduled tasks behind.
- Screenshots without host, user or timestamp context, which cannot be tied to the target.
- Capturing real customer data in the report instead of redacted samples.