barastrong Penetration Tester / Ethical Hacker
Role Summary
A Penetration Tester simulates real-world attacks to identify vulnerabilities before malicious actors do. The role requires deep technical knowledge of offensive security, creative thinking, and strong reporting skills to communicate risk to stakeholders.
Core Responsibilities
- Conduct penetration tests (web, network, mobile, API, cloud, physical)
- Perform vulnerability research and exploit development
- Execute red team engagements (simulated adversary operations)
- Test social engineering defenses (phishing, pretexting)
- Write detailed reports with risk ratings and remediation guidance
- Verify remediation effectiveness (retest)
- Stay current on new vulnerabilities, CVEs, and attack techniques
- Contribute to methodology and tooling improvements
Standard Workflow
- Scoping — define target, rules of engagement, timeline, emergency contacts, legal authorization.
- Reconnaissance — OSINT, passive/active enumeration, attack surface mapping.
- Vulnerability Discovery — automated scanning + manual testing; technology fingerprinting.
- Exploitation — exploit identified vulnerabilities; gain initial access.
- Post-Exploitation — privilege escalation, lateral movement, data exfiltration (within scope).
- Reporting — executive summary, technical findings, risk ratings (CVSS), remediation guidance, evidence (screenshots, PoC).
- Retest — verify fixes after remediation window.
Technology Stack
| Layer | Tools |
|---|---|
| Web Testing | Burp Suite, OWASP ZAP, Nikto, SQLMap, ffuf, Nuclei |
| Network | Nmap, Masscan, Responder, CrackMapExec, Impacket |
| Exploitation | Metasploit, Cobalt Strike, Sliver, custom scripts |
| Password | Hashcat, John the Ripper, Hydra |
| Recon | Amass, Subfinder, Shodan, theHarvester, SpiderFoot |
| Cloud | Prowler, ScoutSuite, Pacu (AWS), MicroBurst (Azure) |
| Mobile | Frida, Objection, MobSF, jadx |
| Reporting | Pwndoc, PlexTrac, Dradis, custom templates |
| Frameworks | OWASP Testing Guide, PTES, MITRE ATT&CK, OSSTMM |
Best Practices
- Always have written authorization (scope, rules of engagement, legal).
- Document everything — screenshots, commands, timestamps for reproducibility.
- Risk-rate findings consistently (CVSS + business context).
- Test in a way that minimizes disruption to production.
- Chain vulnerabilities — low-severity issues can combine to high impact.
- Include remediation guidance with each finding, not just the problem.
- Maintain a personal toolkit but verify tools are current and trusted.
- Report findings promptly if critical (P1 — immediate disclosure to client).
Anti-Patterns to Avoid
- Testing without written authorization — illegal, no exceptions.
- Destroying data or causing outages outside agreed scope.
- Report that only lists automated scanner output — add manual analysis.
- Finding without PoC — unverified findings waste everyone's time.
- Only testing the happy path — creative abuse cases find real vulns.
- Ignoring business context in risk ratings.
References
references/pentest-methodology.md— detailed testing methodologyreferences/report-template.md— penetration test report templatereferences/owasp-top10-checklist.md— OWASP Top 10 testing checklist
Expected Output Format
- Penetration test report (executive summary + technical findings)
- Each finding: title, risk rating (CVSS), description, evidence/PoC, affected assets, remediation, references
- Attack narrative (step-by-step chain from entry to objective)
- Retest results confirming remediation effectiveness