Applying EC-Council's Penetration Testing Methodology
Domain 4 tests whether you can apply a documented, phase-based methodology consistently and explain your choices. EC-Council teaches its own penetration testing methodology inside the official LPT courseware, which candidates receive through authorised enrolment; the exam assesses your ability to execute and justify that process, not to recite slide text.
What applying a methodology actually means
A methodology is a repeatable decision framework: which phase you are in, what input it takes, what evidence it must leave behind, and when it is complete. EC-Council's phase structure follows the classic sequence - reconnaissance, scanning and enumeration, vulnerability analysis, system exploitation, post-exploitation and privilege escalation, then reporting. Each phase produces an artefact: footprinting notes with sources, a service map with versions, a validated vulnerability list, an exploitation log with timestamps, and finally the report. If an artefact is missing, the phase is not finished.
Aligning to recognised frameworks
Clients rarely accept 'because the course said so'. Map your actions outward: PTES for engagement structure, NIST SP 800-115 for technical assessment process, OSSTMM for measurement discipline, and MITRE ATT&CK for technique identifiers. A finding that reads 'credential reuse from a phishing foothold via T1566.001 then T1078 then T1021.002' is auditable; 'we got domain admin' is not. Record deviations from the methodology and the reason, because an unexplained shortcut is a failed control.
Worked example
An internal engagement begins with a spear-phishing simulation that is explicitly authorised. The tester documents: phase one, passive OSINT on the target's mail gateway; phase two, enumeration of accepted attachment types; phase three, validation that macros execute in the current Office build; phase four, a benign payload returning hostname and user context; phase five, credential reuse against SMB with a logged source and destination; phase six, a report mapped to ATT&CK techniques. Each step lists the tool version and the exact command, so a second tester can replay it.
Traps that cost marks
- Presenting a default tool scan as a methodology; there is no analysis, no validation, no artefact.
- Skipping pre-engagement because the client 'obviously' authorised the work.
- Attributing specific claims to EC-Council material you cannot cite; describe the phase, not invented quotes.
- Deviating from the plan silently instead of recording the deviation and its justification.