Learn about pre-engagement, reconnaissance, OSINT, scanning, exploitation, post-exploitation, lateral movement, privilege escalation, retesting, and much more, through the Frequently Asked Questions (FAQs) below. Please schedule a consultation if you are looking for Penetration Testing for compliance or regulatory requirements or to comply with a global security standard..
Table of Contents
What are the phases of a penetration test?
A professional penetration test follows a structured sequence of phases that mirror real-world attacker behavior. Following the widely adopted PTES framework, these phases are: Pre-Engagement (defining scope, rules of engagement, legal agreements, and communication protocols), Reconnaissance / Intelligence Gathering (collecting publicly available and network-visible information about the target), Scanning and Enumeration (actively probing systems to map open ports, services, versions, and attack surface), Vulnerability Analysis (identifying specific weaknesses in discovered services and applications), Exploitation (actively attempting to compromise systems by exploiting confirmed vulnerabilities), Post-Exploitation (assessing the full impact of successful exploitation through lateral movement, privilege escalation, and data access), and Reporting (documenting findings, evidence, risk ratings, and remediation recommendations). Each phase informs the next, and the most skilled testers adapt their approach dynamically based on what they discover throughout the engagement.
What happens during the pre-engagement phase of a pen test?
The pre-engagement phase is the planning and legal foundation of a penetration test, everything that happens before any technical testing begins, ensuring both parties agree on exactly what will be tested, how, and under what legal protections.
During this phase, the client and testing team define the full scope of the engagement, which systems, applications, and IP ranges are in scope and out of scope, and negotiate and sign the rules of engagement, statement of work, NDA, and Letter of Authorization. The testing timeline is confirmed, along with communication protocols: emergency contacts on both sides, procedures for reporting critical findings discovered mid-test, and the process for pausing or stopping the test if unexpected damage occurs. For compliance-driven engagements, the pre-engagement phase includes confirming which specific regulatory requirements the test must satisfy so that methodology and reporting can be tailored accordingly. A thorough pre-engagement phase is the difference between a well-controlled engagement and a chaotic one.
What is reconnaissance (information gathering) in a penetration test?
Reconnaissance, also called information gathering, is the phase of a penetration test in which the tester collects as much information as possible about the target organization, its systems, its people, and its publicly visible infrastructure, before actively probing or attacking anything. Effective reconnaissance gives testers a comprehensive picture of the attack surface and helps them identify the most promising attack vectors to pursue. Reconnaissance techniques include OSINT (Open-Source Intelligence) research using public databases, social media, DNS records, WHOIS lookups, job postings, and leaked credential databases; passive network observation; and analysis of the organization’s digital footprint, including subdomains, exposed APIs, cloud storage buckets, and employee email addresses. The quality and thoroughness of the reconnaissance phase directly determines the quality of the rest of the engagement, testers who invest time here are more likely to identify sophisticated attack paths than those who skip directly to automated scanning.
What is the difference between passive and active reconnaissance?
Passive reconnaissance collects information about a target using only publicly available sources, without directly interacting with the target’s systems, meaning the target organization cannot detect the activity through its own logging or monitoring. Techniques include reviewing WHOIS records, analyzing DNS entries, searching LinkedIn for employee information, examining public GitHub repositories for leaked credentials, and using services like Shodan to identify exposed systems. Active reconnaissance involves directly interacting with the target’s systems, sending network probes, scanning for open ports, or querying services, which generates traffic that the organization’s monitoring tools could potentially detect. In a penetration test, passive reconnaissance typically precedes active reconnaissance: testers gather as much intelligence as possible passively before generating any traffic that might alert the target’s security team.
What is OSINT and how is it used in penetration testing?
OSINT (Open-Source Intelligence) is the collection, analysis, and use of information gathered from publicly available sources, including websites, social media platforms, public records, corporate filings, DNS registries, code repositories, and dark web forums, without any unauthorized access or technical exploitation. In penetration testing, OSINT is used during the reconnaissance phase to build a detailed profile of the target organization: identifying employee names and email addresses (useful for social engineering and credential stuffing), discovering subdomains and IP ranges in scope, finding exposed API documentation, identifying technology stack information through job postings, and locating previously leaked credentials in breach databases. OSINT is legal and ethical because it only uses publicly available information. Common OSINT tools used by penetration testers include Maltego, theHarvester, Shodan, Recon-ng, and SpiderFoot. The OSINT Framework (osintframework.com) is a widely referenced resource that catalogues hundreds of OSINT tools and data sources organized by information category.
What happens during the scanning and enumeration phase of a pen test?
The scanning and enumeration phase is where the penetration tester directly probes the target systems to build a detailed, technical map of the attack surface, moving from general network discovery to specific service and version identification.
Scanning identifies which IP addresses are live (host discovery), which ports are open (port scanning), which services are running on those ports (service detection), and which software versions are in use (version fingerprinting). Tools such as Nmap, Masscan, and Nessus are commonly used for network scanning. Enumeration goes deeper, it extracts specific information from discovered services, such as user account names from LDAP or SMB, share names from file services, database names from database servers, and software version details that can be matched against known vulnerabilities. The output of the scanning and enumeration phase directly informs the vulnerability analysis and exploitation phases, and also forms part of the evidence documented in the final penetration test report.
What happens during the exploitation phase of a pen test?
The exploitation phase is the phase in which the penetration tester actively attempts to compromise systems by leveraging the vulnerabilities identified in the scanning and vulnerability analysis phases. Unlike automated vulnerability scanners that only flag potential issues, exploitation confirms that a vulnerability is real, exploitable, and impactful. Testers use a combination of publicly known exploits (such as those catalogued in the CVE database or available through frameworks like Metasploit), custom exploit code, and manual exploitation techniques to gain unauthorized access to systems, extract data, or demonstrate the impact of a successful attack. The exploitation phase is conducted within the agreed scope and rules of engagement, testers stop short of causing damage, and proof of concept (PoC) evidence is captured through screenshots and logs rather than by actually exfiltrating sensitive data. Every successful exploitation during this phase becomes a documented finding in the final report.
What is post-exploitation in a penetration test?
Post-exploitation is the phase of a penetration test that occurs after an initial system or account has been successfully compromised, it assesses what an attacker could do with that access if they were not stopped at the point of initial compromise. Post-exploitation activities include lateral movement (attempting to access additional systems within the network using compromised credentials or exploits), privilege escalation (attempting to gain higher-level permissions, such as moving from a standard user account to domain administrator), persistence (establishing mechanisms to maintain access, such as creating new accounts or installing backdoors), and data discovery (identifying what sensitive data is accessible from the compromised position). Post-exploitation is critical because many organizations have strong perimeter controls but weak internal controls, a tester who gains access through a single phishing-vulnerable employee might, through post-exploitation, reach domain controllers, financial databases, or medical records within hours.
What is lateral movement and why is it tested in a pen test?
Lateral movement is the set of techniques an attacker uses to progressively expand their access through an organization’s internal network after gaining an initial foothold, moving from system to system to reach high-value targets such as domain controllers, databases, financial systems, or sensitive data repositories. Real attackers invest significant time in lateral movement, the average dwell time (the time between initial compromise and detection) was 16 days in 2023 according to Mandiant’s M-Trends report, during which attackers can move deeply into a network undetected. Penetration testers test lateral movement capabilities to reveal whether network segmentation controls are effective, whether internal systems are adequately hardened, whether privileged accounts are properly protected, and whether the organization’s detection tools would alert on suspicious internal traffic. Common lateral movement techniques include Pass-the-Hash, Pass-the-Ticket, use of remote management tools such as PsExec and WMI, and exploitation of internal services.
What is privilege escalation and how is it tested?
Privilege escalation is the technique by which an attacker, or a penetration tester, moves from a low-privileged account or access level to a higher one, ultimately seeking administrative or root-level control over systems. There are two main types: vertical privilege escalation (gaining higher permissions than initially granted, such as moving from a standard user to administrator) and horizontal privilege escalation (accessing resources or functions belonging to another user at the same permission level). Penetration testers test for privilege escalation vulnerabilities by attempting techniques such as exploiting misconfigured sudo rules on Linux systems, abusing Windows services with weak permissions, exploiting unquoted service paths, abusing Active Directory delegation settings, exploiting token impersonation vulnerabilities, and leveraging overly permissive IAM roles in cloud environments. Privilege escalation testing is critical because attackers almost never achieve their objectives with the access level they initially obtain, escalation is the bridge between initial access and full compromise.
What is a proof of concept (PoC) in a penetration test?
A proof of concept (PoC) in a penetration test is documented evidence that a specific vulnerability is real, exploitable, and impactful, confirming to the client organization that the issue is not a false positive and showing exactly how an attacker could exploit it. PoCs are typically presented in the penetration test report as screenshots showing successful exploitation, command outputs demonstrating unauthorized access, sample payloads that triggered the vulnerability, and step-by-step reproduction instructions that the organization’s technical team can follow to verify the finding. A well-constructed PoC is one of the most valuable components of a penetration test report: it removes ambiguity, convinces non-technical stakeholders of the severity, and gives developers the precise context they need to fix the issue. Professional penetration testers capture PoC evidence during the engagement rather than reconstructing it afterward, and they are careful to demonstrate impact without causing actual damage to systems or data.
What happens after a penetration test is completed?
After active testing concludes, the penetration testing team enters the reporting phase, compiling, organizing, and writing up all findings, evidence, and remediation recommendations into a formal penetration test report. The report is typically delivered within five to fifteen business days of testing completion, depending on the scope and complexity of the engagement. After the report is delivered, the client organization reviews the findings with the testing team in a debrief call or meeting, asking questions and clarifying technical details. The organization then enters the remediation phase, prioritizing and fixing the vulnerabilities identified based on severity and business impact. Most professional penetration testing engagements include a retest as part of the engagement package, allowing the testing team to confirm that critical and high-severity findings have been successfully remediated. The final deliverables, signed-off report, retest confirmation, and any attestation letters, are then retained for compliance documentation purposes.
What is a retest (or remediation verification) in penetration testing?
A retest, also called a remediation verification, is a follow-up security testing activity conducted after an organization has remediated the vulnerabilities identified in the original penetration test. The purpose is to confirm that the fixes applied actually resolve the identified vulnerabilities and have not introduced new issues. A retest is narrower in scope than the original engagement, testers focus specifically on previously identified findings rather than conducting a full assessment. Some penetration testing firms include a single retest within the original engagement price; others charge separately. PCI DSS explicitly requires retesting after significant vulnerability remediation. Organizations should prioritize retesting for critical and high-severity findings and retain the retest report as compliance audit evidence.
What happens if a penetration tester discovers a real breach or active attacker during a test?
If a penetration tester discovers evidence of an actual, unauthorized breach or an active threat actor within the client’s environment during a penetration test, they are obligated to immediately stop testing, notify the client’s designated emergency contact as specified in the rules of engagement, and document what they found without disturbing potential forensic evidence. This scenario, sometimes called “finding an uninvited guest”, does occur in practice and is one of the most important reasons to have clear emergency escalation procedures defined in the pre-engagement documentation. The client organization must then initiate its incident response plan: the penetration test is paused or terminated, and the organization shifts to containment, investigation, and remediation of the actual incident. Most professional penetration testing contracts address this scenario explicitly, clarifying that the tester’s obligation upon discovering evidence of a real breach is immediate notification rather than continued testing. Organizations should brief their incident response team before a pen test begins so they are prepared to activate quickly if needed.
Explore Blogs, Webinars and other Resources
Trusted by Reputed Companies
Accreditations and Associations
* Disclaimer: This list of accreditations is held by our team of employees and consultants.
What Our Clients Say
We used databrackets (formerly EHR 2.0) in our small medical practice for our risk analysis assessment to be in compliance with meaningful use. Their response was fast, the final report is detailed but simple and easy to follow. They were always available to answer our questions.
E. Compres
Pulmonary and Sleep Center of the Valley
I never miss the opportunity to learn something new …that’s why I am always registering to all free seminars offered on the web. databrackets (formerly EHR 2.0) happened to be the friendliest, comprehensive and up-to- date source of HIPAA Privacy and Security updates.
Alexandra V.
Community Healthcare Network
Today’s presentation was great! Thank you for sending the slides. My only feedback is that it would be fabulous to have the slides ahead of time so I could print them and take notes on the slides.Thanks for your time and knowledge today!
T.B., PM
Community Health Network
Particularly interesting was the flow chart on Administrative Simplification. I utilize all of the Security subcategories you list under the Security tile and appreciate knowing that I am hitting all of the relevant topics during my employee training.
Jessica B.
JD, CHC
I have re-worked our original risk assessment….We are using databrackets' (formerly EHR 2.0) Meaningful Use Security Risk Analysis Toolkit and it meets our needs. It was easy to use and I believe that it very beneficial to our meeting meaningful use.
Bill Curtis
Neurosurgical Associates Of Texarkana, TX
Information (webinars) presented by databrackets (formerly EHR 2.0) highlights some of today’s most demanding healthcare topics. The webinars help to direct those operating in today’s rapidly changing environment in the right direction.
Candace M.
Privacy and Security Officer, Springhill Medical Center
Our Growing List of Credentials
0
+
Assessments
0
+
Clients
0
+
Assessment Libraries
0
+
Years of Experience
0
+
No. of Staff Trained
0
+
HIPAA
0
+
SOC 2 Readiness
0
+
Pen Testing
0
+
ISO 27001 Certifications
0
+
Dollars Saved in Compliance Penalties