Penetration Testing Methodologies and Techniques
Penetration Testing Methodologies and Techniques
This domain tests execution discipline: choosing a method, moving through it in order, validating findings, and preserving evidence without damaging the target. Expect questions on reconnaissance, enumeration, exploitation, post-exploitation, and how standards map to phases.
Core rules
- PTES gives seven phases: pre-engagement interactions, intelligence gathering, threat modeling, vulnerability analysis, exploitation, post-exploitation, and reporting. NIST SP 800-115 gives four: planning, discovery, attack, reporting. OWASP WSTG structures web testing by category; MITRE ATT&CK maps observed behavior to tactics and techniques.
- Reconnaissance is passive first (OSINT, DNS, certificate transparency, breach data) then active (scanning, service enumeration, directory discovery). Validate every candidate finding manually before reporting.
- Exploitation should be minimally sufficient: prove impact with the least invasive payload, respect rate limits, and avoid persistence unless explicitly in scope. Post-exploitation proves business impact, then cleanup removes artifacts.
- Evidence must be reproducible: timestamps, requests and responses, command output, affected asset, and test account. Screenshots alone are weak without context.
- Detection validation and purple-team feedback turn a test into program improvement; record whether the activity was detected and how.
Worked example
A login page issues password-reset tokens that appear sequential. You create two test accounts, request resets, and observe token values. Rather than brute-forcing production, you test a small, consented sample, record the requests, and confirm whether one account's token resets another account's password. You stop before account lockout thresholds affect real users. Reasoning: the flaw is an authorization issue, not just a token pattern; proof requires showing cross-account impact with minimal user disruption.
Traps
Reporting raw scanner output; using destructive payloads; leaving shells or test data behind; testing out of scope 'because it was adjacent'; and failing to distinguish a vulnerability from an exploitable finding.