Quick answer: A penetration testing methodology is a structured, repeatable process for legally simulating attacks to find security weaknesses. Most methodologies follow the same core phases: 1) pre-engagement and scoping, 2) reconnaissance (OSINT), 3) scanning and enumeration, 4) vulnerability analysis, 5) exploitation, 6) post-exploitation, and 7) reporting and retesting. The most widely used frameworks are PTES, OWASP WSTG, NIST SP 800-115, OSSTMM and MITRE ATT&CK.
Whether you are hiring a pentester, preparing for a certification, or starting a security career, understanding methodology is what separates professional testing from random hacking. This guide explains each phase with the tools used, compares the major frameworks, and lays out a realistic career path for 2026.
What Is Penetration Testing?
Penetration testing (pentesting) is an authorised simulated attack on systems, applications or people to find vulnerabilities before real attackers do. It differs from a vulnerability scan: a scan lists potential weaknesses, while a pentest proves which ones can actually be exploited and what the business impact would be.
Types of penetration tests
| Type | Focus |
|---|---|
| External network | Internet-facing servers, VPNs, firewalls |
| Internal network | What an attacker or insider could do inside the network (often Active Directory) |
| Web application | Authentication, access control, injection, business logic |
| API | REST/GraphQL endpoints, authorisation flaws |
| Cloud | AWS, Azure, GCP misconfigurations and identity |
| Mobile | Android/iOS apps and their back ends |
| Wireless | Wi-Fi security and rogue access points |
| Social engineering | Phishing, vishing, physical access |
Black, grey and white box
- Black box: the tester starts with little or no information, like an outside attacker.
- Grey box: limited information, such as a user account. The most common and cost-effective option.
- White box: full access to documentation or source code for the deepest coverage.
The 7 Phases of a Penetration Testing Methodology
Phase 1: Pre-engagement and scoping
Agree on goals, in-scope and out-of-scope assets, testing windows, rules of engagement, emergency contacts and legal authorisation. Written permission is non-negotiable; without it, testing can be a crime.
Phase 2: Reconnaissance (intelligence gathering)
Collect information about the target using OSINT: domains, subdomains, IP ranges, technologies, employees and email formats, leaked credentials and exposed documents. Passive recon avoids touching the target; active recon interacts with it.
Tools: SpiderFoot, theHarvester, Amass, Recon-ng, Shodan and search engines. SpiderFoot is especially efficient because it automates 200+ sources in one scan; learn how in what SpiderFoot is and how it automates OSINT and see how red and blue teams use it.
Phase 3: Scanning and enumeration
Identify live hosts, open ports, services, versions, users and shares. Tools: Nmap, Masscan, Nessus or OpenVAS, enum4linux, and web crawlers.
Phase 4: Vulnerability analysis
Match findings to known vulnerabilities (CVEs), misconfigurations and weak credentials, then prioritise by risk. Validate scanner results manually to remove false positives. Useful references: CVE/NVD, CISA’s Known Exploited Vulnerabilities catalogue and vendor advisories.
Phase 5: Exploitation
Safely demonstrate that a vulnerability can be used to gain access or data. Tools: Metasploit, Burp Suite, sqlmap, Impacket, and custom scripts. Stay within scope and avoid actions that could harm availability unless explicitly allowed.
Phase 6: Post-exploitation
Assess impact: privilege escalation, lateral movement, access to sensitive data and persistence, all within the rules of engagement. Tools: BloodHound, Mimikatz (in authorised tests), PowerShell and Linux enumeration scripts. Document everything and clean up afterwards.
Phase 7: Reporting and retesting
The report is the real deliverable. A good pentest report includes an executive summary, methodology and scope, findings with severity (for example CVSS), evidence, business impact and clear remediation steps. A retest confirms fixes worked.
Penetration Testing Frameworks Compared
| Framework | Maintained by | Best for | Key strength |
|---|---|---|---|
| PTES (Penetration Testing Execution Standard) | Community | General network and infrastructure tests | Clear 7-phase structure from pre-engagement to reporting |
| OWASP WSTG (Web Security Testing Guide) | OWASP | Web applications and APIs | Detailed test cases; pairs with the OWASP Top 10 and ASVS |
| NIST SP 800-115 | US NIST | Government and compliance-driven programs | Planning, execution and post-test guidance for security testing |
| OSSTMM | ISECOM | Operational security measurement | Scientific, metrics-based approach across channels |
| MITRE ATT&CK | MITRE | Red teaming and adversary emulation | Real-world attacker tactics and techniques mapping |
| OWASP MASTG | OWASP | Mobile apps | Mobile-specific tests aligned with MASVS |
In practice, most teams combine them: PTES for the overall process, WSTG for web apps, and ATT&CK to map techniques and detections.
Compliance: When Pentesting Is Required
- PCI DSS v4.0: requires internal and external penetration testing at least annually and after significant changes, plus segmentation testing.
- ISO/IEC 27001, SOC 2, HIPAA and GDPR do not always mandate pentests by name, but they expect regular technical security testing, and pentests are the common evidence.
- EU DORA requires threat-led penetration testing (TLPT) for certain financial entities.
Essential Pentesting Toolkit (2026)
| Phase | Popular tools |
|---|---|
| OS / platform | Kali Linux, Parrot OS |
| Recon / OSINT | SpiderFoot, Amass, theHarvester, Shodan |
| Scanning | Nmap, Masscan, Nessus, OpenVAS, Nuclei |
| Web testing | Burp Suite, OWASP ZAP, ffuf, sqlmap |
| Exploitation | Metasploit, Impacket, CrackMapExec/NetExec |
| Active Directory | BloodHound, Rubeus, Certipy |
| Passwords | Hashcat, John the Ripper |
| Reporting | Markdown/Word templates, Dradis, SysReptor |
Set up your recon stack quickly: install SpiderFoot on Kali Linux and learn the SpiderFoot commands you will use in real engagements.
Penetration Testing Career Guide
Core skills
- Networking (TCP/IP, DNS, HTTP, routing)
- Linux and Windows administration, including Active Directory
- Web technologies and common vulnerabilities (OWASP Top 10)
- Scripting in Python, Bash or PowerShell
- Clear technical writing for reports
Popular certifications
| Level | Certifications |
|---|---|
| Entry | CompTIA Security+, eJPT, CompTIA PenTest+ |
| Intermediate | OSCP (OSCP+), PNPT, CEH (practical) |
| Advanced | OSEP, OSWE, CRTO, GIAC GPEN/GXPN |
A realistic learning path
- Learn networking and Linux fundamentals.
- Practise OSINT and recon with tools like SpiderFoot. Start with our SpiderFoot beginner tutorial.
- Do hands-on labs (Hack The Box, TryHackMe, PortSwigger Web Security Academy).
- Earn an entry certification, then OSCP or PNPT.
- Build a portfolio: write-ups, sample reports, bug bounty findings.
- Apply for SOC, junior pentester or security analyst roles.
Common job titles
Junior penetration tester, penetration tester, application security tester, red team operator, security consultant. Salaries vary widely by country and experience, and experienced testers are consistently among the better-paid security roles.
Ethics and Legal Rules
- Always get written authorisation and stay in scope.
- Protect client data and delete it after the engagement.
- Report findings responsibly and never use them for personal gain.
- Secure your own tools and results; recon data is sensitive. See how to secure SpiderFoot data.
Frequently Asked Questions
What are the phases of penetration testing?
The common phases are pre-engagement and scoping, reconnaissance, scanning and enumeration, vulnerability analysis, exploitation, post-exploitation, and reporting with retesting.
Which penetration testing framework is best?
It depends on the target. PTES suits general infrastructure tests, OWASP WSTG is best for web applications, NIST SP 800-115 fits compliance-driven programs, and MITRE ATT&CK is ideal for red teaming.
What is the difference between a vulnerability scan and a penetration test?
A vulnerability scan automatically lists potential weaknesses. A penetration test uses skilled testers to confirm which weaknesses are exploitable and shows the real business impact.
How often should a company do penetration testing?
At least annually and after significant changes to systems or applications. Standards such as PCI DSS v4.0 make this a requirement.
Which tools are used for reconnaissance in penetration testing?
Popular recon tools include SpiderFoot, Amass, theHarvester, Recon-ng and Shodan. SpiderFoot automates data collection from more than 200 sources.
Which certification should I start with for pentesting?
Beginners often start with CompTIA Security+, eJPT or PenTest+, then move to hands-on certifications like OSCP or PNPT.
Conclusion
A strong penetration testing methodology turns hacking skills into trustworthy, repeatable results. Follow the seven phases, choose frameworks that fit the target (PTES, OWASP WSTG, NIST SP 800-115, OSSTMM, MITRE ATT&CK), automate reconnaissance with tools like SpiderFoot, and invest in clear reporting. For a career, build solid fundamentals, practise in labs, and earn hands-on certifications.
Pingback: SpiderFoot for Red Team & Blue Team: Offensive vs Defensive