Penetration Testing: Methodology, Tools, and the Art of Ethical Hacking

What Is Penetration Testing?

Penetration testing (pentesting) is the authorized simulation of cyberattacks against computer systems to evaluate their security. Unlike vulnerability scanning (which is automated), pentesting involves human creativity, lateral thinking, and the ability to chain multiple low-severity findings into a critical exploit path.

Think of it this way: a vulnerability scanner finds that a door is unlocked. A penetration tester opens the door, walks through the building, finds the safe, and demonstrates that the company's crown jewels are accessible—then writes a report explaining how to fix it.

Types of Penetration Tests

The Penetration Testing Methodology

Most pentesters follow a structured methodology based on frameworks like PTES (Penetration Testing Execution Standard) or OWASP Testing Guide:

Penetration Testing Phases:

┌─────────────────────────────────────────────┐
│ Phase 1: Reconnaissance (Passive & Active)  │
│  ├─ OSINT: Company info, employee names     │
│  ├─ DNS enumeration, subdomain discovery    │
│  ├─ Technology fingerprinting               │
│  └─ Network scanning and service detection  │
├─────────────────────────────────────────────┤
│ Phase 2: Vulnerability Analysis             │
│  ├─ Automated scanning (Nessus, Nuclei)     │
│  ├─ Manual testing (business logic)         │
│  ├─ Source code review (if white box)       │
│  └─ Configuration analysis                  │
├─────────────────────────────────────────────┤
│ Phase 3: Exploitation                       │
│  ├─ Exploit known vulnerabilities           │
│  ├─ Chain multiple findings                 │
│  ├─ Bypass security controls                │
│  └─ Demonstrate business impact             │
├─────────────────────────────────────────────┤
│ Phase 4: Post-Exploitation                  │
│  ├─ Privilege escalation                    │
│  ├─ Lateral movement                        │
│  ├─ Data access and exfiltration proof      │
│  ├─ Persistence (if in scope)               │
│  └─ Pivot to other network segments         │
├─────────────────────────────────────────────┤
│ Phase 5: Reporting                          │
│  ├─ Executive summary                       │
│  ├─ Technical findings with evidence        │
│  ├─ Risk ratings (CVSS, business impact)    │
│  ├─ Remediation recommendations             │
│  └─ Retest verification                     │
└─────────────────────────────────────────────┘

Essential Pentesting Tools

Reconnaissance

# Subdomain enumeration with Subfinder
subfinder -d target.com -o subdomains.txt

# Port scanning with Nmap
nmap -sC -sV -O -oA scan_results target.com
# -sC: default scripts  -sV: version detection
# -O: OS detection  -oA: output all formats

# Comprehensive web recon with httpx
cat subdomains.txt | httpx -sc -title -tech-detect -o live_hosts.txt

# Directory brute-forcing with Feroxbuster
feroxbuster -u https://target.com -w /usr/share/wordlists/dirb/common.txt

Web Application Testing

# Burp Suite is the industry standard (GUI tool)
# But for CLI-based testing:

# SQLMap — automated SQL injection detection
sqlmap -u "https://target.com/search?q=test" --batch --dbs

# Nuclei — template-based vulnerability scanner
nuclei -u https://target.com -t cves/ -t vulnerabilities/ -severity critical,high

# ffuf — fast web fuzzer
ffuf -u https://target.com/FUZZ -w wordlist.txt -mc 200,301,302,403

Exploitation and Post-Exploitation

# Metasploit Framework — exploitation platform
msfconsole
msf6 > search eternalblue
msf6 > use exploit/windows/smb/ms17_010_eternalblue
msf6 > set RHOSTS target_ip
msf6 > exploit

# Impacket — Windows protocol attack tools
# Pass-the-hash attack
impacket-psexec administrator@target_ip -hashes :ntlm_hash

# CrackMapExec — Active Directory lateral movement
crackmapexec smb 192.168.1.0/24 -u admin -p password --shares

# BloodHound — Active Directory attack path visualization
bloodhound-python -u user -p password -d domain.local -c all

A Real-World Pentest Example: Web Application

Here's a simplified walkthrough of how a web application pentest might unfold:

Target: https://app.example.com (e-commerce platform)
Scope: Web application + API endpoints
Type: Gray box (given test credentials)

Step 1: Reconnaissance
├─ Technology: Next.js frontend, Django REST API
├─ Subdomains: api.example.com, staging.example.com
├─ Staging has default credentials (admin:admin) → Finding #1
└─ API documentation exposed at /api/docs → Finding #2

Step 2: Vulnerability Analysis
├─ IDOR on /api/orders/{id} — can view any user's orders → Finding #3 (High)
├─ No rate limiting on /api/auth/login → Finding #4 (Medium)
├─ JWT token doesn't expire for 30 days → Finding #5 (Medium)
└─ Reflected XSS in search parameter → Finding #6 (Medium)

Step 3: Exploitation (chaining findings)
├─ Use IDOR to enumerate all orders (PII exposure)
├─ Find admin user's email from order data
├─ Brute-force admin login (no rate limiting)
├─ Access admin panel with admin credentials
├─ Admin panel allows file upload without validation
└─ Upload web shell → Remote Code Execution → Finding #7 (Critical)

Step 4: Post-Exploitation
├─ Read database credentials from environment variables
├─ Access production database (200K customer records)
├─ Demonstrate data access (screenshot, not exfiltrate)
└─ Document the full attack chain

Step 5: Report
├─ Critical: RCE via admin panel file upload + weak auth
├─ High: IDOR exposing all customer orders
├─ Medium: Missing rate limiting, long-lived JWT, XSS
├─ Low: Staging environment exposed, API docs public
└─ Recommendations for each finding with priority

CVSS Scoring: How Vulnerabilities Are Rated

The Common Vulnerability Scoring System rates findings from 0.0 to 10.0:

Bug Bounty Programs

Bug bounties allow anyone to find and report vulnerabilities for rewards:

Certifications for Penetration Testers

The OSCP (Offensive Security Certified Professional) remains the most respected hands-on certification. The 24-hour practical exam requires exploiting multiple machines in a simulated network.

Legal and Ethical Considerations

Penetration testing without authorization is illegal in most jurisdictions. Before any engagement:

1. Written authorization: Signed scope document (Rules of Engagement)
2. Scope boundaries: Exactly which systems/IPs are in scope
3. Testing windows: When testing is allowed
4. Emergency contacts: Who to call if something breaks
5. Data handling: How to handle sensitive data discovered during testing
6. Legal protections: Liability clauses protecting the tester

Ethical hackers follow the principle: find vulnerabilities, report them, help fix them. The goal is always to make systems more secure, never to cause harm.

Sources: OWASP Testing Guide, PTES Standard, HackerOne Hacktivity