# Pentesting Methodology

> Use this skill whenever you need to perform penetration testing, security assessments, vulnerability research, or red team operations. This covers the complete pentesting workflow from reconnaissance through privilege escalation and pivoting. Make sure to use this skill when the user mentions pentesting, security testing, vulnerability assessment, network scanning, privilege escalation, or any security-related attack methodology, even if they don't explicitly ask for a 'pentesting methodology'.

- Skill: `abelrguezr/pentesting-methodology` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add abelrguezr/pentesting-methodology`
- Raw SKILL.md: https://api.skillmd.com/api/skills/abelrguezr/pentesting-methodology/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: abelrguezr (https://skillmd.com/u/abelrguezr)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/abelrguezr/pentesting-methodology

---


# Pentesting Methodology

A comprehensive guide for conducting penetration tests and security assessments. This skill provides a structured approach to security testing from initial reconnaissance through post-exploitation.

## ⚠️ Ethical Considerations

**Always ensure you have explicit authorization before performing any security testing.** This methodology should only be used:
- On systems you own or have written permission to test
- In authorized penetration testing engagements
- In controlled lab environments for learning
- During bug bounty programs within scope

## Methodology Overview

Follow this structured approach for comprehensive security assessments:

### Phase 0: Physical Access Assessment

If you have physical access to target systems:
- Review physical attack vectors (USB drops, keyloggers, hardware implants)
- Consider GUI escape techniques for locked workstations
- Document physical security controls and bypass opportunities

### Phase 1: Asset Discovery

**Internal Tests:**
- Discover hosts within the network using ARP scanning, Nmap, and network enumeration
- Map network topology and identify critical infrastructure

**External Tests:**
- Enumerate company assets on the internet (domains, subdomains, cloud resources)
- Use OSINT tools to gather publicly available information
- Once internal access is gained, restart from Phase 1 for internal discovery

### Phase 2: Network Intelligence (Internal Only)

Before targeting specific hosts:
- **Passive reconnaissance:** Sniff network traffic to understand protocols and data flows
- **Active reconnaissance:** Perform MITM attacks to intercept credentials and sessions
- **Credential harvesting:** Capture NTLM hashes, Kerberos tickets, or plaintext credentials
- Document network protocols, services, and potential attack surfaces

### Phase 3: Port Scanning & Service Discovery

**Essential scanning workflow:**
1. **Initial scan:** Quick port scan to identify open ports
2. **Service enumeration:** Identify running services and versions
3. **Deep scan:** Comprehensive scan with version detection and script scanning
4. **Documentation:** Record all findings with timestamps

**Recommended tools:**
- Nmap for comprehensive scanning
- Masscan for rapid port discovery
- Rustscan for fast initial sweeps

### Phase 4: Vulnerability Research

For each discovered service:
1. **Version identification:** Determine exact service versions
2. **CVE lookup:** Search for known vulnerabilities (Exploit-DB, NVD, GitHub)
3. **Exploit availability:** Check for public exploits or proof-of-concepts
4. **Risk assessment:** Prioritize based on severity and exploitability

**Resources:**
- Exploit-DB for public exploits
- NVD for CVE information
- GitHub for custom exploits and tools
- Vendor security advisories

### Phase 5: Service-Specific Testing

**When no direct exploits exist:**
- Test for common misconfigurations
- Check for default credentials
- Test for authentication bypasses
- Look for information disclosure
- Attempt parameter tampering

**Web applications (highest priority):**
- SQL injection testing
- XSS vulnerability assessment
- Authentication/authorization testing
- File upload vulnerabilities
- Business logic flaws

**Common services to test:**
- SSH, RDP, VNC (remote access)
- SMB, NFS (file sharing)
- HTTP/HTTPS (web services)
- Database services (MySQL, PostgreSQL, MongoDB)
- Mail services (SMTP, IMAP, POP3)

**Automated tools:**
- Legion for automated vulnerability assessment
- Nessus/OpenVAS for vulnerability scanning
- Custom scripts for service-specific testing

**Brute-force considerations:**
- Use wordlists appropriate to the service
- Implement rate limiting to avoid detection
- Document all attempts for reporting
- Consider credential stuffing if hashes are available

### Phase 6: Social Engineering

**When technical vectors fail:**
- Phishing campaigns (email, SMS, voice)
- Credential harvesting pages
- Malicious document delivery
- Business email compromise scenarios

**Important:** Only use social engineering with explicit authorization and within legal boundaries.

### Phase 7: Initial Access

**Once a vulnerability is identified:**
1. **Exploit development:** Adapt or write exploits as needed
2. **Payload delivery:** Choose appropriate payload (reverse shell, bind shell, web shell)
3. **Shell establishment:** Gain initial interactive access
4. **Stabilization:** Upgrade to stable shell if needed

**Reverse shell considerations:**
- Choose appropriate language (bash, python, netcat, powershell)
- Consider firewall/AV evasion
- Use encrypted channels when possible
- Have backup access methods ready

**Windows-specific:**
- AV evasion techniques for payloads
- Use encoded or obfuscated commands
- Consider living-off-the-land binaries (LOLBins)

### Phase 8: Post-Access Enumeration

**Linux systems:**
- User enumeration (`/etc/passwd`, `last`, `w`)
- Privilege escalation paths (SUID binaries, cron jobs, capabilities)
- Network connections and listening services
- Installed software and versions
- Scheduled tasks and startup scripts

**Windows systems:**
- User and group enumeration
- Service and process analysis
- Registry persistence locations
- Scheduled tasks and startup items
- Credential storage locations
- Active Directory information (if domain-joined)

### Phase 9: Data Exfiltration

**Data extraction methods:**
- Direct file transfer (SCP, FTP, HTTP)
- Encrypted channels (DNS tunneling, HTTPS)
- Steganography for covert channels
- Compression and encoding for large datasets

**Data to prioritize:**
- Credentials and password hashes
- Sensitive documents and databases
- Configuration files with secrets
- Source code and intellectual property
- Network topology information

### Phase 10: Privilege Escalation

**Local Privilege Escalation:**

**Linux:**
- Kernel exploits (check kernel version)
- SUID/SGID binary abuse
- Capability exploitation
- Cron job manipulation
- Service misconfigurations
- Use PEAS (Privilege Escalation Awesome Scripts) for enumeration

**Windows:**
- Service exploitation
- Token manipulation
- UAC bypass techniques
- Unquoted service paths
- Weak service permissions
- Use WinPEAS for enumeration

**Domain Privilege Escalation:**
- Active Directory enumeration
- Trust relationship exploitation
- Kerberos attacks (AS-REP roasting, Golden Ticket)
- Lateral movement techniques
- Credential dumping (Mimikatz, secretsdump)
- GPO abuse and manipulation

### Phase 11: Post-Exploitation

**Looting:**
- Search for additional credentials
- Check for access to other systems
- Dump password hashes and cached credentials
- Look for configuration files with secrets
- Identify high-value targets

**Persistence:**
- Implement 2-3 different persistence mechanisms
- **Windows:** Scheduled tasks, services, registry run keys, WMI subscriptions
- **Linux:** Cron jobs, systemd services, bashrc modifications
- **Active Directory:** GPO modifications, ACL changes, DC shadowing
- Document all persistence for cleanup

### Phase 12: Pivoting

**Network pivoting:**
- SSH tunneling for port forwarding
- SOCKS proxies for network access
- Meterpreter pivoting (if using Metasploit)
- Chisel/SSHuttle for advanced tunneling

**Lateral movement:**
- Use harvested credentials on other systems
- Pass-the-hash/Pass-the-ticket attacks
- WMI/WinRM for Windows lateral movement
- SSH key abuse for Linux environments

**When pivoting:**
- Restart methodology from Phase 1 for new networks
- Document network topology changes
- Update asset inventory
- Consider new attack vectors

## Specialized Testing Areas

### Mobile Application Testing
- Android application security assessment
- APK analysis and decompilation
- Runtime analysis and hooking
- API security testing

### Binary Exploitation
- Stack-based buffer overflows
- Format string vulnerabilities
- Return-oriented programming (ROP)
- Windows-specific exploitation techniques

### Cryptographic Analysis
- ECB mode vulnerabilities
- CBC-MAC weaknesses
- Padding oracle attacks
- Weak key generation and usage

## Documentation & Reporting

**During the engagement:**
- Document all findings with timestamps
- Capture screenshots and logs
- Record commands and outputs
- Track progress through methodology phases

**Final report should include:**
- Executive summary for management
- Technical findings with severity ratings
- Proof-of-concept evidence
- Remediation recommendations
- Risk assessment and prioritization

## Tools Reference

**Reconnaissance:**
- Nmap, Masscan, Rustscan
- Subfinder, Amass, Assetfinder
- Shodan, Censys for external assets

**Vulnerability Assessment:**
- Legion, Nessus, OpenVAS
- Nikto, WPScan for web applications
- Burp Suite for web testing

**Exploitation:**
- Metasploit Framework
- Custom exploit development
- Exploit-DB search tools

**Post-Exploitation:**
- PEAS/WinPEAS for enumeration
- Mimikatz for credential access
- BloodHound for AD analysis
- Empire/Cobalt Strike for C2

**Pivoting:**
- SSH tunneling
- Chisel, SSHuttle
- Proxychains for routing

## Safety Reminders

1. **Authorization:** Never test without written permission
2. **Scope:** Stay within agreed boundaries
3. **Timing:** Avoid production impact during business hours
4. **Data handling:** Protect any sensitive data discovered
5. **Cleanup:** Remove all persistence and access methods
6. **Reporting:** Document everything for the client

## When to Use This Skill

Use this methodology when:
- Planning a penetration test engagement
- Conducting security assessments
- Learning penetration testing techniques
- Developing security testing procedures
- Creating bug bounty testing strategies
- Performing authorized red team operations
- Documenting security testing processes

This skill provides the framework - adapt specific techniques to your target environment and engagement scope.