Penetration Testing Phases Explained, Step by Step

A professional penetration test follows a method, not a mood. Each phase has a purpose and produces something the next phase needs. Frameworks such as PTES and NIST's SP 800-115 describe it in slightly different words, but the shape is the same. Here are the phases as they run in a real engagement.

1. Pre-Engagement and Scoping

Agree what will be tested, when, how, and what is off limits. Sign the authorization. Agree on emergency contacts and how data will be handled. A test without this is not a penetration test; it is an offense. Output: a signed scope and rules of engagement.

2. Reconnaissance

Gather information about the target. Passive reconnaissance uses public sources: DNS records, websites, job listings, code repositories, leaked-credential reports. Active reconnaissance touches the target lightly, within scope. Output: a list of hosts, domains, technologies and people relevant to the test. See OSINT for beginners.

3. Scanning and Enumeration

Find live hosts, open ports and running services with tools such as Nmap, then dig into each service: versions, shares, users, web directories. In Windows networks this includes enumerating Active Directory. Output: a detailed map of the attack surface. See Nmap for beginners.

4. Vulnerability Analysis

Match what you found against known weaknesses, using scanners such as Nessus and your own checks, then verify which results are real. Output: a short list of promising, confirmed weaknesses.

5. Exploitation

Attempt to use chosen weaknesses to gain access, carefully and within the agreed rules, avoiding damage to live systems. Output: proof of access, with evidence.

6. Post-Exploitation

From the first foothold, see how far an attacker could go: escalate privileges, move to other systems, reach sensitive data. In Active Directory this is where attack paths appear. Stop at proof; do not keep access or take data beyond what is agreed. Output: the attack path and its business impact.

7. Reporting

Write the report: an executive summary for managers, technical findings with evidence and severity, and clear fixes in priority order. This is what the client pays for. See how to write a penetration testing report.

8. Remediation Support and Retesting

Answer the client's questions while they fix the issues, then retest to confirm each fix works. Output: an updated report with retest status.

Learning the Method

Our network and Active Directory course follows these phases in order and ends with a full assessment and report. The Application Security course applies the same method to applications, including a formal retest.