Host and Network Penetration Testing
Core workflow
Host and network testing follows a repeatable chain: passive and active reconnaissance, port and service scanning, enumeration of users/shares/services, exploitation, privilege escalation, lateral movement or pivoting, and post-exploitation cleanup. Know how Nmap states work (open, closed, filtered) and why a filtered result usually means a firewall dropped the probe rather than that no host exists. Service banners and version strings matter more than open-port counts because they drive vulnerability lookup.
Shells and payloads
A bind shell listens on the target and the attacker connects inward; a reverse shell makes the target connect back to a listener you control. Reverse shells are preferred when egress filtering is loose or the target sits behind NAT. With Metasploit, remember the difference between an exploit module, a payload, and a handler; msfvenom generates standalone payloads, while multi/handler catches them. Netcat remains the simplest listener and file-transfer tool.
Traps candidates hit
Questions often blur enumeration with exploitation, or treat a successful exploit as the end of the engagement. Privilege escalation on Linux (SUID binaries, sudo misconfigurations, cron jobs) and Windows (unquoted service paths, weak service permissions, token privileges) is a separate phase. Pivoting questions frequently hinge on routing: Metasploit autoroute plus a SOCKS proxy, or SSH dynamic port forwarding with proxychains, lets you reach an internal subnet through a compromised host. Do not confuse -sS SYN scanning with -sT connect scanning when stealth or privileges are mentioned.
Rule of thumb
If a target cannot route back to you, do not assume a reverse shell will work; test connectivity first, then choose bind versus reverse. Always verify a vulnerability manually before reporting it, and record the exact command, timestamp, and output as evidence.