// pentest — a methodical approach (step by step)
Penetration testing is not just an attack: it is a structured, planned process, and above all one framed by written authorization. This tutorial details the four phases of an engagement, with the tools and the reasoning behind each. A non-negotiable reminder: only act on systems you own or with formal authorization.
Phase 1 — Reconnaissance (Recon)
Goal: map the target without raising alarms. Two aspects:
- Passive — OSINT: whois, DNS history, mentions on social networks, leaks. No packet is sent to the target.
- Active — DNS resolution, subdomain scanning, web fingerprinting. Here you touch the target, so proceed with caution and within the agreed scope.
$ whois target.com $ theharvester -d target.com -b google
Phase 2 — Scan / Enumeration
We identify the exposed services. Nmap is the Swiss Army knife:
$ nmap -sS -sV -O -p- 10.0.0.10 PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.2 80/tcp open http Apache 2.4.41 3306/tcp open mysql MySQL 5.7
Options: -sS (SYN stealth), -sV (versions), -O (OS), -p- (all ports). For web, add a directory scan (gobuster, feroxbuster) and check the technologies in use (wappalyzer).
Phase 3 — Exploitation
Once a vulnerability is identified (e.g. a vulnerable service, default credentials, SQL injection), it is exploited. Metasploit centralizes known exploits:
$ msfconsole msf> search type:exploit platform:linux msf> use exploit/multi/http/apache_struts msf> set RHOSTS 10.0.0.10 msf> run
Tip: before exploiting in a live environment, reproduce it in a lab (e.g. Metasploitable, DVWA). Understand the why, not just the how.
Phase 4 — Post-exploitation
Once you are through the door: maintain access, escalate privileges, and above all prove the impact.
- Privesc — find a SUID binary, a misconfigured service, a vulnerable kernel (linpeas, winpeas).
- Credential access — mimikatz (Windows), extracting /etc/shadow, hashcat to crack hashes.
- Pivot — use the compromised machine as a jump box into the internal network.
$ hashcat -m 1800 hashes.txt rockyou.txt $ ssh -D 9050 user@pivot # SOCKS tunnel
Ethical and legal framework
A pentest without written authorization is a crime. The rules of engagement (RoE) define: the scope (IPs, applications), the authorized methods, the time windows, and the prohibition on degrading the service. The final deliverable is a report: vulnerabilities, evidence (screenshots), and a prioritized remediation plan.
Legal training
Lab platforms: HackTheBox, TryHackMe, Root-Me, PortSwigger Web Security Academy. Install Kali Linux in a VM. Document every solution (write-up): that is how the skill takes root.
Golden rule: the best defense is built by understanding the attack. A good pentester thinks like a defender.