Penetration Test Engagement Methodology
Work through a structured, repeatable methodology for authorized penetration tests.
When to Use
- You are planning or executing a penetration test with written authorization
- You need to ensure coverage and consistency across an engagement
- You are preparing deliverables for a client or internal stakeholder
Hard Rules
- Never test without written authorization. Verify the scope statement, rules of engagement (RoE), and emergency contacts before touching anything.
- Stay in scope. Check every IP, domain, and URL against the scope document before testing. If unsure, ask — do not guess.
- No destructive actions unless explicitly authorized: no DoS, no data destruction, no production brute-force lockouts.
Phases
1. Scoping and Planning
- Capture in-scope assets, out-of-scope assets, testing windows, and escalation paths
- Identify the engagement type: black/grey/white box
- Agree on evidence-handling and data-destruction requirements
- Prepare the test plan and get sign-off
2. Reconnaissance
- Passive first: certificate transparency, DNS records, public code, job postings
- Active second: port scanning, service fingerprinting, subdomain enumeration
- Build an asset inventory with owner notes and observed technologies
3. Vulnerability Analysis
- Map the attack surface to likely vulnerability classes per technology
- Manual verification of every finding — scanners produce noise; you produce evidence
- Rank candidate findings by exploitability and business impact
4. Exploitation
- Use the least invasive proof that proves the finding (POC > payload)
- Document: request, response, tool, version, and timestamp for every exploit attempt
- Stop and escalate to the client if you reach a critical system boundary
5. Post-Exploitation
- Demonstrate impact: what data or access the foothold yields
- Attempt privilege escalation and lateral movement only within RoE
- Clean up: remove shells, scripts, and artifacts; record what was created where
6. Reporting
- Executive summary: business risk in plain language
- Findings: title, severity (CVSS), affected assets, reproduction steps, evidence, remediation advice
- Retest criteria and positive observations
Output Format
Deliver: test plan, asset inventory, findings report with evidence, cleanup log, and a debrief agenda.
1---2name: pentest-engagement-methodology3description: Execute an authorized penetration test end-to-end, from scoping and rules of engagement through reconnaissance, exploitation, post-exploitation, and reporting. Use when planning or running an offensive security engagement.4---56# Penetration Test Engagement Methodology78Work through a structured, repeatable methodology for authorized penetration tests.910## When to Use1112- You are planning or executing a penetration test with written authorization13- You need to ensure coverage and consistency across an engagement14- You are preparing deliverables for a client or internal stakeholder1516## Hard Rules17181. **Never test without written authorization.** Verify the scope statement, rules of engagement (RoE), and emergency contacts before touching anything.192. **Stay in scope.** Check every IP, domain, and URL against the scope document before testing. If unsure, ask — do not guess.203. **No destructive actions** unless explicitly authorized: no DoS, no data destruction, no production brute-force lockouts.2122## Phases2324### 1. Scoping and Planning2526- Capture in-scope assets, out-of-scope assets, testing windows, and escalation paths27- Identify the engagement type: black/grey/white box28- Agree on evidence-handling and data-destruction requirements29- Prepare the test plan and get sign-off3031### 2. Reconnaissance3233- Passive first: certificate transparency, DNS records, public code, job postings34- Active second: port scanning, service fingerprinting, subdomain enumeration35- Build an asset inventory with owner notes and observed technologies3637### 3. Vulnerability Analysis3839- Map the attack surface to likely vulnerability classes per technology40- Manual verification of every finding — scanners produce noise; you produce evidence41- Rank candidate findings by exploitability and business impact4243### 4. Exploitation4445- Use the least invasive proof that proves the finding (POC > payload)46- Document: request, response, tool, version, and timestamp for every exploit attempt47- Stop and escalate to the client if you reach a critical system boundary4849### 5. Post-Exploitation5051- Demonstrate impact: what data or access the foothold yields52- Attempt privilege escalation and lateral movement only within RoE53- Clean up: remove shells, scripts, and artifacts; record what was created where5455### 6. Reporting5657- Executive summary: business risk in plain language58- Findings: title, severity (CVSS), affected assets, reproduction steps, evidence, remediation advice59- Retest criteria and positive observations6061## Output Format6263Deliver: test plan, asset inventory, findings report with evidence, cleanup log, and a debrief agenda.
securityskills