Intro to Penetration Testing: Ethical Hackers

What Penetration Testing Is — and Is Not

A penetration test (pentest) is an authorized, simulated attack on a system, network, or application to identify security weaknesses before real attackers find them. The key word is authorized. The technical skills of a penetration tester and a criminal attacker are often identical. The difference is legal permission and intent.

Penetration testing is not the same as a vulnerability scan. A scanner identifies known vulnerabilities by comparing systems against a database. A penetration tester attempts to exploit those vulnerabilities to demonstrate real-world impact — chaining weaknesses together, escalating privileges, and moving through systems the way an actual attacker would.

It is also not the same as a red team engagement. A red team simulates a full adversary campaign — often over weeks or months — testing people, processes, and technology. A penetration test is typically more scoped and time-limited.

The Legal and Ethical Foundation

Before any testing begins, a penetration tester must have explicit written authorization. This typically takes the form of a Rules of Engagement (ROE) document and a Statement of Work that define:

• Scope: which systems, IP ranges, and applications are in scope
• Out-of-scope systems: production databases you cannot touch, third-party services
• Permitted techniques: is social engineering allowed? Physical access?
• Timing: are there maintenance windows to avoid?
• Emergency contacts: if something breaks, who gets called immediately?

Testing without authorization is illegal under computer fraud laws in virtually every jurisdiction (the Computer Fraud and Abuse Act in the US, the Computer Misuse Act in the UK, and equivalents elsewhere). A get-out-of-jail-free letter from the client — sometimes literally called that — should be carried during any testing that could trigger security alerts.

The Five Phases of a Penetration Test

Phase 1: Reconnaissance

Reconnaissance (recon) is the information-gathering phase. The tester learns everything possible about the target before touching any system. This breaks into two categories:

Passive reconnaissance uses publicly available information without interacting with the target:

• WHOIS records, DNS records, certificate transparency logs
• LinkedIn for employee names, job titles, technology stack hints
• GitHub and code repositories for leaked credentials, API keys, internal IP addresses
• Shodan.io and Censys for internet-exposed services
• Google dorking (site:target.com filetype:pdf, site:target.com inurl:login)

Active reconnaissance involves direct interaction with the target:

• DNS enumeration and zone transfers
• Port scanning (Nmap)
• Service fingerprinting
• Web application crawling

Thoughtful recon often reveals findings without any exploitation: publicly exposed .git directories, exposed environment files, default credentials on administrative interfaces.

Phase 2: Scanning and Enumeration

With a target list established, the tester systematically scans for open ports, running services, software versions, and misconfigurations.

Key tools:

• Nmap — the standard for port and service scanning
• Nikto — web server vulnerability scanner
• Gobuster / ffuf — directory and file brute-forcing on web applications
• Enum4linux — SMB and Windows enumeration
• Nessus / OpenVAS — automated vulnerability scanners

Enumeration goes deeper: extracting usernames from LDAP, identifying SMB shares, discovering API endpoints, mapping the application's logic.

Phase 3: Exploitation

Exploitation attempts to leverage discovered vulnerabilities to gain unauthorized access. The goal is typically to achieve one of:

• Remote code execution (RCE) on a target system
• Authentication bypass to access protected resources
• Privilege escalation from a low-privilege to a high-privilege user
• Data exfiltration to demonstrate what an attacker could steal

Metasploit Framework is the most widely used tool for organizing and executing exploits. It provides a library of modules for known vulnerabilities, payload generation, and post-exploitation.

A critical skill here is chaining vulnerabilities. A low-severity misconfiguration might not warrant action on its own, but combined with an information disclosure and a weak password, it becomes a path to domain administrator.

Phase 4: Post-Exploitation

After initial access, testers simulate what a real attacker would do: maintain persistence, move laterally, escalate privileges, and reach their objectives.

Lateral movement techniques:

• Pass-the-Hash: using captured NTLM hashes to authenticate without knowing the plaintext password
• Kerberoasting: requesting service tickets and cracking them offline to obtain service account passwords
• Pivoting: using a compromised host as a bridge to reach systems that were not directly accessible

Persistence techniques:

• Scheduled tasks, cron jobs
• Registry run keys
• Backdoor accounts
• Web shells on compromised web servers

The depth of post-exploitation is constrained by the ROE.

Phase 5: Reporting

The report is the primary deliverable of a penetration test. A good report:

• Provides an executive summary accessible to non-technical leadership
• Lists every finding with severity rating (CVSS score or qualitative: Critical/High/Medium/Low)
• Documents a proof of concept for each finding (screenshots, commands used)
• Explains business impact — not just "SQL injection found" but "attacker could access all customer payment records"
• Provides specific remediation guidance, not generic advice
• Includes a remediation roadmap prioritized by risk

Common Methodologies and Frameworks

• PTES (Penetration Testing Execution Standard) — comprehensive methodology covering all phases
• OWASP Testing Guide — for web application testing specifically
• NIST SP 800-115 — technical guide to information security testing
• OSSTMM (Open Source Security Testing Methodology Manual) — broader security testing methodology

Getting Started in Penetration Testing

For those pursuing penetration testing professionally:

Practice environments:

• HackTheBox, TryHackMe, PentesterLab — intentionally vulnerable machines
• DVWA (Damn Vulnerable Web Application) — local web app practice
• VulnHub — downloadable vulnerable virtual machines

Certifications:

• OSCP (Offensive Security Certified Professional) — hands-on, industry-respected, difficult
• CEH (Certified Ethical Hacker) — widely recognized, more knowledge-based
• eJPT (eLearnSecurity Junior Penetration Tester) — good starting point

Key tools to learn: Nmap, Metasploit, Burp Suite, Wireshark, John the Ripper, Hashcat, Gobuster, BloodHound

The penetration testing mindset is fundamentally about creative problem-solving within constraints. Technical knowledge matters, but the ability to think like an attacker — to identify what defenders have overlooked — is what separates effective testers from tool operators.