Phases Of Penetration Testing | Basic Ethical Hacking Course |

Like most things, the overall process of penetration testing can be broken 

down into a series of steps or phases. When put together, these steps form a 

comprehensive methodology for completing a penetration test. Careful review 

of unclassified incident response reports or breech disclosures supports the 

idea that most black hat hackers also follow a process when attacking a target. 

The use of an organized approach is important because it not only keeps the 

penetration tester focused and moving forward but also allows the results or 

output from each step to be used in the ensuing steps.

The use of a methodology allows you to break down a complex process into a 

series of smaller more manageable tasks. Understanding and following a meth-

odology is an important step in mastering the basics of hacking. Depending 

on the literature or class you are taking, this methodology usually contains 

between four and seven steps or phases. Although the overall names or num-

ber of steps can vary between methodologies, the important thing is that 

the process provides a complete overview of the penetration testing process.

We can break down the Penetration Testing into 5 stages i. e., 

• Information Gathering or Reconnaissance 
• Scanning 
• Gaining Access
• Maintaining Access
• Exploitation 

1. Information Gathering or Reconnaissance 

In this phase, the attacker gathers as much information about the target as possible. The information can be IP addresses, domain details, mail servers, network topology, etc. An expert hacker will spend most of the time in this phase, this will help with further phases of the attack.

2. Scanning

This is the phase where the attacker will interact with the target with an aim to identify the vulnerabilities. An attacker will send probes to the target and records the response of the target to various inputs. This phase includes- scanning the network with various scanning tools, identification of open share drives, open FTP portals, services that are running, and much more. In case of a web application, the scanning part can be either dynamic or static. In static scanning, the application code is scanned by either a YTool or an expert application vulnerability analyst. The aim is to identify the vulnerable functions, libraries and logic implemented. In dynamic analysis, the tester will pass various inputs to the application and record the responses; various vulnerabilities like injection, cross-site scripting, remote code execution can be identified in this phase.

3. Gaining Access 

Once the vulnerabilities have been identified, the next step is to exploit the vulnerabilities with an aim to gain access to the target. The target can be a system, firewall, secured zone or server. Be aware that not all vulnerabilities will lead you to this stage. You need to identify the ones that are exploitable enough to provide you with access to the target.

4. Maintaining Access

The next step is to ensure that the access is maintained; i.e., persistence. This is required to ensure that the access is maintained even if the system is rebooted, reset or modified. This kind of persistence is used by attackers who live in the system and gain knowledge about them over a period of time, and when the environment is suitable, they exploit.

5. Exploitation

This is the phase where the actual damage is done. An attacker will try to get the data, compromise the system, launch dos attacks, etc. Usually, this phase is controlled in penetration testing so as to ensure that the mayhem on the network is limited. This phase is modified in this way- a dummy flag is placed in the critical zone, may be in the database; the aim of the exploitation phase will be to get the flag. Revealing the contents of the flag will be enough to ensure practical exploitation of the network or data theft.