Overview
Throughout the entire penetration testing process, detailed notes & screenshots should be consistently captured for the final proof of concept report, and to assist with cleanup.
- Pre-Engagement - Create the legal documents and set the scope for the penetration test target
- Information Gathering - Gather information passively and actively to determine how to complete objectives
- Vulnerability Assessment - Find a weakness in the information gathered
- Exploitation - Sending specially crafted data to the weakness(es) discovered to gain access to a target
- Post-Exploitation - Running commands to maintain access (persistence), gain further permissions (privilege escalation) or transmit internal files out (exfiltration). Cycle restarts back to Info Gathering using internal access to reveal new targets
- Lateral Movement - Utilizes information and access to move onto new internal targets. Cycle continues to repeat while hopping from target to target until objective is met.
- Proof-of-Concept - Report created from all prior steps to demonstrate how exploitation occurred and can be re-created.
- Post-Engagement - Clean-up of pentest artifacts, delivery of PoC report with recommendations, adhering to regulations on evidence retention and encryption.