# Pentest Engagement Methodology

> Execute an authorized penetration test end-to-end, from scoping and rules of engagement through reconnaissance, exploitation, post-exploitation, and reporting. Use when planning or running an offensive security engagement.

- Skill: `securityskills/pentest-engagement-methodology` (Agent Skill)
- Install (CLI): `npx skillmds@latest add securityskills/pentest-engagement-methodology`
- Raw SKILL.md: https://api.skillmd.com/api/skills/securityskills/pentest-engagement-methodology/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: securityskills (https://skillmd.com/u/securityskills)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/securityskills/pentest-engagement-methodology

---


# Penetration Test Engagement Methodology

Work through a structured, repeatable methodology for authorized penetration tests.

## When to Use

- You are planning or executing a penetration test with written authorization
- You need to ensure coverage and consistency across an engagement
- You are preparing deliverables for a client or internal stakeholder

## Hard Rules

1. **Never test without written authorization.** Verify the scope statement, rules of engagement (RoE), and emergency contacts before touching anything.
2. **Stay in scope.** Check every IP, domain, and URL against the scope document before testing. If unsure, ask — do not guess.
3. **No destructive actions** unless explicitly authorized: no DoS, no data destruction, no production brute-force lockouts.

## Phases

### 1. Scoping and Planning

- Capture in-scope assets, out-of-scope assets, testing windows, and escalation paths
- Identify the engagement type: black/grey/white box
- Agree on evidence-handling and data-destruction requirements
- Prepare the test plan and get sign-off

### 2. Reconnaissance

- Passive first: certificate transparency, DNS records, public code, job postings
- Active second: port scanning, service fingerprinting, subdomain enumeration
- Build an asset inventory with owner notes and observed technologies

### 3. Vulnerability Analysis

- Map the attack surface to likely vulnerability classes per technology
- Manual verification of every finding — scanners produce noise; you produce evidence
- Rank candidate findings by exploitability and business impact

### 4. Exploitation

- Use the least invasive proof that proves the finding (POC > payload)
- Document: request, response, tool, version, and timestamp for every exploit attempt
- Stop and escalate to the client if you reach a critical system boundary

### 5. Post-Exploitation

- Demonstrate impact: what data or access the foothold yields
- Attempt privilege escalation and lateral movement only within RoE
- Clean up: remove shells, scripts, and artifacts; record what was created where

### 6. Reporting

- Executive summary: business risk in plain language
- Findings: title, severity (CVSS), affected assets, reproduction steps, evidence, remediation advice
- Retest criteria and positive observations

## Output Format

Deliver: test plan, asset inventory, findings report with evidence, cleanup log, and a debrief agenda.