I85PREP
⌘ K
LPF LPQ study materials
LPF LPQ study resources

LPF LPQ: Penetration Testing Methodology and Tooling

LPF LPQ · Work through your exam, one topic at a time.

All guide sections

Penetration Testing Methodology and Tooling

Penetration Testing Methodology and Tooling

This domain tests whether you can run a repeatable engagement: choose a methodology, select tools by task, keep evidence, and avoid tool-driven testing. The exam values process knowledge as much as command syntax.

Core rules and concepts

  • Frameworks: PTES for engagement phases, OSSTMM for measurement, NIST SP 800-115 for technical testing, OWASP WSTG for web, MITRE ATT&CK for adversary behavior mapping, and MASVS/MSTG for mobile.
  • Phases: pre-engagement, intelligence gathering, threat modeling, vulnerability analysis, exploitation, post-exploitation, reporting. Pre-engagement defines scope, RoE, contacts, and success criteria.
  • Tool categories: recon (Amass, theHarvester), scanning (Nmap, masscan), web proxies (Burp Suite, ZAP), exploitation (Metasploit, manual PoCs), credentials (Hydra, Hashcat), AD (BloodHound, Impacket), wireless (Aircrack-ng, hcxtools), mobile (MobSF, Frida), C2 only when authorized.
  • Validate tool output manually, record versions and commands, and keep a timestamped log.
  • Automate repetitive checks, but review results; false positives are common.
  • Use isolated labs for exploit development and destructive testing.

Worked example

A web application engagement starts with PTES pre-engagement, then uses OWASP WSTG as the test checklist. The tester maps each WSTG item to a tool or manual test: Burp for request manipulation, manual review for business logic, and SQLmap only for confirmation after a manual injection signal. Commands, versions, and raw requests are logged. Findings are mapped to OWASP Top 10 categories for the client. Running an automated scanner first and calling the output the methodology would fail the process requirement.

Traps that cost marks

  • Tool-first testing with no methodology or coverage map.
  • Relying on one scanner and not validating output.
  • Skipping pre-engagement or success criteria.
  • Not recording tool versions, commands, or timestamps.
  • Running destructive tests outside an isolated lab.
  • Treating ATT&CK as a test checklist rather than a behavior map.