IT PATH
My Path

Penetration Testing Methodology

Plan and scope authorised security tests with legal agreements, rules of engagement, and structured reconnaissance.

Certification
CompTIA PenTest+
Recommended study time
6h 30m
Status
Not started

Recommended study time

About 6h 30m in total, measured from the material on this page. At your session length of 45 minutes that is 9 sittings.

  • Read the lesson19 min

    About 2,409 words at a careful technical reading pace.

  • Second pass with notes11 min

    Re-read the harder parts and write your own notes.

  • Recall from memory12 min

    2 written recall questions.

  • Practice decision12 min

    One applied decision with feedback.

  • Teach it back20 min

    Write the topic in your own words.

  • Real-world scenario15 min

    Read the situation and justify your decision in writing.

  • Hands-on practice3h 20m

    Labs, commands and configuration until you can do it unaided.

  • Spaced review1h 40m

    4 short review sessions spread over the following weeks.

Learning objectives

  • Define scope, authorisation, and rules of engagement before testing begins.
  • Perform passive and active reconnaissance proportionate to scope.
  • Distinguish vulnerability scanning from penetration testing and red teaming.

Start here

About 8 minutes of reading, in 10 short parts.

Penetration testing is authorised, structured hacking meant to prove what a real attacker could actually do, not just what a scanner flags. The entire discipline rests on written permission and defined boundaries; without those, the exact same technical actions become a crime.

Where you meet it: A junior tester joins an engagement kickoff call where the client, lawyers, and lead tester agree exact scope, timing, and emergency contacts before a single command is run.

The lesson, part by part

Open one part at a time. Each part stands on its own, so you can stop and come back.

Imagine hiring a locksmith to test whether your house's locks are secure, and giving them written permission to try picking specific doors during specific hours, with your phone number in case anything goes wrong. That written agreement is what separates a security test from a burglary, even though the physical actions might look identical from the outside.

Penetration testing works exactly the same way in the digital world. The techniques a penetration tester uses are often the same ones a criminal uses, but the agreement beforehand about what can be touched, when, and how, is what makes the whole exercise legal and useful rather than reckless.

Key ideas

If you remember nothing else from this topic, remember these.

  • A penetration test follows a defined methodology with distinct phases so findings are reproducible and legally authorised throughout.
  • The rules of engagement and signed scope document define exactly what is permitted before any technical activity begins.
  • Passive and active reconnaissance gather information without and with direct interaction with target systems respectively.
  • Enumeration turns broad reconnaissance into a specific, actionable list of services, versions, and potential entry points.
  • Exploitation should be attempted carefully within scope, with a plan for what happens if a system becomes unstable.
  • Post-exploitation activities like privilege escalation and lateral movement demonstrate real business impact beyond initial access.

Running an authorised external penetration test

A worked example, step by step.

A consulting firm is engaged to test a client's external network perimeter under a signed statement of work with a two-week window.

  1. 01Pre-engagementFinalise rules of engagement specifying in-scope IP ranges, excluded systems (a fragile legacy billing server), test window hours, and an emergency contact for critical findings.
  2. 02Passive reconnaissanceUse OSINT tools and DNS records to identify subdomains, employee names from LinkedIn, and technology stack hints from job postings, without touching target infrastructure directly.
  3. 03Active reconnaissance and scanningRun Nmap with -sV -sC against the in-scope range, discovering an outdated Apache version on a public web server and an exposed VPN endpoint.
  4. 04EnumerationUse Nikto and manual browsing to enumerate the web application, finding a login form vulnerable to SQL injection confirmed with a single quote causing a database error.
  5. 05ExploitationExploit the SQL injection with sqlmap to extract the user credentials table, then reuse a recovered administrator hash against the exposed VPN endpoint using a cracked password.
  6. 06Privilege escalationAfter VPN access, find the internal jump host has an unpatched local privilege escalation vulnerability and gain SYSTEM access, mapping the technique to T1068.
  7. 07Lateral movement and objectiveFrom the jump host, access a file share containing sensitive customer records, satisfying the engagement's defined objective of demonstrating data exposure impact.
  8. 08Cleanup and reportingRemove all created accounts, uploaded tools, and shells, then begin drafting the report with a full timeline and evidence for each step.

Outcome: The test demonstrates a complete attack path from external SQL injection to internal sensitive data access, fully authorised and cleanly reversed, providing the client concrete evidence for remediation prioritisation.

Penetration testing methodology reference

Worth keeping at hand while you work.

Rules of engagement
Document defining scope, timing, and limits before testing begins
Passive reconnaissance
Information gathering without direct target interaction, such as OSINT
Active reconnaissance
Direct interaction with targets, such as port scanning
Enumeration
Identifying specific services, versions, and users for exploitation planning
T1068
Exploitation for Privilege Escalation
T1021
Remote Services, used for lateral movement
T1003
OS Credential Dumping
Nmap -sV -sC
Service version detection with default scripts
sqlmap
Automated SQL injection exploitation tool
Cleanup phase
Removing all test artifacts, accounts, and shells after the engagement
Black box test
Testing with no prior knowledge of internal systems
White box test
Testing with full internal knowledge and credentials provided

Common misunderstandings

What most beginners get wrong here.

  • Penetration testing is just running an automated vulnerability scanner.

    A scanner identifies potential issues, while a penetration test manually exploits them to prove real business impact and chain findings together.

  • Scope can be figured out informally once testing begins.

    Rules of engagement must be signed and finalised before any technical activity to avoid legal exposure and accidental damage.

  • Once initial access is gained, the engagement objective is met.

    Most engagements require demonstrating post-exploitation impact like privilege escalation or data access, not just a foothold.

  • Cleanup is optional if the client does not ask about it.

    Removing test accounts, shells, and tools is a required professional and ethical step regardless of whether the client explicitly requests it.

  • Black box and white box testing find the same issues.

    White box testing with credentials and internal knowledge typically finds more issues faster since less time is spent on reconnaissance.

Exam traps

How the question writers try to catch you out.

  • PenTest+ exam scenarios test the correct ordering of methodology phases: planning, reconnaissance, scanning and enumeration, exploitation, post-exploitation, reporting.
  • Expect questions distinguishing passive from active reconnaissance techniques by whether they touch the target directly.
  • Exam items test that rules of engagement, not verbal agreement, are the authoritative scope document during a test.
  • Watch for scenarios describing an unstable system during exploitation and expecting the tester to pause and consult the emergency contact per the rules of engagement.
  • Questions often test knowing cleanup and artifact removal is a mandatory phase, not an afterthought.

Check yourself

Answer in your head first, then reveal. This is not scored.

  • What document defines scope and limits before a test begins?

  • What is the difference between passive and active reconnaissance?

  • Why is post-exploitation activity typically required in an engagement?

  • What ATT&CK technique describes exploiting a flaw to gain SYSTEM privileges?

  • Why is cleanup a required phase?

Quick reference

A condensed summary of the lesson above, for revision.

What It Is

A penetration test follows planning and scoping, reconnaissance, enumeration and vulnerability identification, exploitation, post-exploitation, and reporting. Legal foundations include a signed statement of work, rules of engagement covering timing, targets, and prohibited actions, emergency contacts, and evidence-handling requirements. Reconnaissance may be passive (public sources) or active (direct interaction).

Why It Matters

Testing without clear authorisation risks criminal liability and business disruption. Poorly scoped tests also produce reports that nobody can act on, which wastes the exercise entirely.

How It Works

  • Scoping defines targets, timing, techniques, and success criteria in writing.
  • Reconnaissance builds an attack surface picture before any intrusive action.
  • Findings are recorded continuously with evidence for the final report.

Where You See It

  • Annual assurance testing, pre-release application assessment, compliance requirements, and acquisition due diligence.

Key Terms

Rules of engagement
Agreed constraints on timing, targets, and techniques.
Scope
The systems and actions explicitly authorised.
OSINT
Open-source intelligence gathered without touching the target.
Enumeration
Identifying services, versions, and accessible functionality.
Deconfliction
Confirming whether observed activity is the test or a real attack.

Examples

  • A test that discovers an out-of-scope host must stop and seek written scope change.
  • Deconfliction contacts let the client distinguish tester activity from a genuine intrusion.

Common Problems

  • Scope creep
  • Testing during peak business hours
  • Unavailable emergency contacts
  • Untracked evidence
  • Findings without reproduction steps

How It Fails

  • Out-of-scope testing can breach contracts or law even with good intent.
  • Disruptive techniques during business hours can cause a genuine outage.
  • A report without reproduction steps cannot be verified or remediated.

How to Troubleshoot

  1. Stop and confirm authorisation when scope becomes ambiguous.
  2. Contact the deconfliction channel if the client reports unexpected impact.
  3. Record timestamps and source addresses so activity can be attributed later.

Practical Knowledge

  • Keep meticulous notes as you go; reconstructing evidence afterwards is unreliable.
  • Agree in advance what happens if you discover an active compromise.

Exam Coverage

  • Planning, scoping, and legal considerations
  • Reconnaissance and enumeration
  • Testing types and methodology

Interview Questions

  • What must be agreed before testing starts?
  • What do you do if you find evidence of a real intrusion mid-test?

Watch and read

Verified official and reputable sources for this topic. Links open in a new tab.

Video training

  • Professor Messer video channel — general CompTIA training (no dedicated CompTIA PenTest+ course)

    Professor Messer

    Video
    Free
    Watch

Lesson notes and bookmark

Notes and bookmarks for this lesson, saved with everything else you have marked.

No notes on this item yet.

Learning progress

0% across six evidence areas. Reading alone does not change progress.

Understanding0%
Recall0%
Application0%
Practical ability0%
Troubleshooting0%
Retention0%

Prerequisites

Next steps

  1. 01Draft rules of engagement for a hypothetical internal test.
  2. 02Perform passive reconnaissance on a domain you own and list what is exposed.