Post cover image

July 23, 2026

Penetration Testing (PT) Phases | By Dharavath Nagaraju

In this write-up, I will explain the five major phases of penetration testing. Each phase has a specific objective and plays an important…

By Dharavathnagaraju

6 min read

In this write-up, I will explain the five major phases of penetration testing. Each phase has a specific objective and plays an important role in identifying, validating, and documenting security vulnerabilities. Understanding these phases provides a clear picture of how penetration testers systematically assess the security of a system, network, or application

The standard phases of penetration testing are:

  1. Planning and Reconnaissance (Information Gathering)
  2. Scanning and Enumeration
  3. Exploitation (Gaining Access)
  4. Post-Exploitation (Maintaining Access and Privilege Escalation)
  5. Analysis and Reporting

Phase 1: Planning and Reconnaissance (Information Gathering)

Planning and Reconnaissance is the first phase of penetration testing, where the main goal is to collect as much information as possible about the target before doing any attacks. This phase is very important because it helps the tester understand how the target system works and where possible weaknesses might be.

None

In the planning stage, things like the scope of testing, objectives, rules, and permissions are decided. This makes sure that everything is done legally and within the allowed limits.

The reconnaissance stage is about gathering information about the target. There are two types:

  • Passive Reconnaissance: This means collecting information without directly interacting with the target. For example, using public sources like WHOIS, DNS records, or searching online.
  • Active Reconnaissance: This involves directly interacting with the target system to find things like open ports, running services, and live hosts.

Information Discovered

  • Domain and WHOIS information
  • DNS records (A, MX, TXT, NS, etc.)
  • Subdomains
  • Public IP addresses
  • Web technologies and frameworks
  • Email addresses
  • Employee information
  • Public documents and metadata
  • Internet-facing assets and exposed services

Tools Used in this Phase

Passive Reconnaissance Tools

| Tool                      | Purpose                                                             |
| ------------------------- | ------------------------------------------------------------------- |
| **Google Dorks**          | Find publicly indexed information                                   |
| **WHOIS**                 | Retrieve domain registration details                                |
| **dig / nslookup**        | Query DNS records                                                   |
| **Subfinder**             | Discover subdomains                                                 |
| **Amass (Passive Mode)**  | Asset and subdomain discovery                                       |
| **Assetfinder**           | Find public subdomains                                              |
| **crt.sh**                | Search Certificate Transparency logs                                |
| **theHarvester**          | Collect emails, hostnames, and domains                              |
| **Wappalyzer**            | Identify website technologies                                       |
| **BuiltWith**             | Detect web technologies and frameworks                              |
| **WhatWeb**               | Fingerprint web technologies (can be passive with limited requests) |
| **Shodan**                | Discover Internet-exposed devices and services                      |
| **Censys**                | Search public Internet assets and certificates                      |
| **GitHub Search**         | Find public repositories and exposed code                           |
| **GitLeaks / TruffleHog** | Detect exposed secrets in repositories                              |
| **ExifTool**              | Extract metadata from public documents                              |
| **Have I Been Pwned**     | Check for leaked email addresses                                    |

Active Reconnaissance Tools

| Tool                     | Purpose                                                        |
| ------------------------ | -------------------------------------------------------------- |
| **Nmap**                 | Host discovery, port scanning, service detection, OS detection |
| **Masscan**              | High-speed port scanning                                       |
| **Netcat (nc)**          | Banner grabbing and port testing                               |
| **Telnet**               | Test connectivity to open ports                                |
| **hping3**               | Custom packet crafting and network probing                     |
| **Ping**                 | Check if a host is reachable                                   |
| **Traceroute / tracert** | Discover the network path to a target                          |
| **Nikto**                | Scan web servers for common vulnerabilities                    |
| **Gobuster**             | Directory, file, and DNS brute-forcing                         |
| **Dirsearch**            | Discover hidden directories and files                          |
| **Enum4linux**           | Enumerate SMB shares, users, and groups                        |
| **SMBclient**            | Interact with SMB shares                                       |
| **SNMPwalk**             | Enumerate SNMP information                                     |
| **LDAPsearch**           | Query LDAP directories                                         |
| **rpcclient**            | Enumerate Windows RPC services                                 |
| **Nmap NSE Scripts**     | Perform advanced service and vulnerability enumeration         |

Phase 2: Scanning and Enumeration

After gathering information during the reconnaissance phase, the next step is Scanning and Enumeration. The main goal of this phase is to actively interact with the target to identify live systems, open ports, running services, operating systems, users, shares, and potential vulnerabilities. This phase helps penetration testers build a complete map of the target's attack surface.

Scanning focuses on discovering hosts, open ports, services, operating systems, and known vulnerabilities. Enumeration goes one step further by extracting detailed information from the identified services, such as usernames, shared folders, domain information, network shares, databases, and software versions.

None

Information Discovered

  • Live hosts on the network
  • Open TCP/UDP ports
  • Running services and service versions
  • Operating system details
  • Web server banner
  • Hidden directories and files
  • SMB shares and users
  • SNMP information
  • LDAP and Active Directory details
  • Databases and their versions
  • Known vulnerabilities (CVEs)
  • Network topology and exposed services

Common Scanning Tools

  • Nmap — Host discovery, port scanning, service and OS detection
  • Masscan — High-speed port scanning
  • RustScan — Fast port discovery with Nmap integration
  • Nikto — Web server vulnerability scanning
  • Nessus — Vulnerability assessment
  • OpenVAS (Greenbone) — Open-source vulnerability scanner
  • Qualys — Cloud-based vulnerability scanning
  • Burp Suite — Web application scanning and crawling
  • OWASP ZAP — Automated web vulnerability scanning
  • Gobuster / Dirsearch / FFUF — Directory and file discovery

Common Enumeration Tools

  • Nmap NSE Scripts — Service and vulnerability enumeration
  • Enum4linux — SMB user and share enumeration
  • SMBclient — Access and enumerate SMB shares
  • rpcclient — Windows RPC enumeration
  • SNMPwalk — Enumerate SNMP information
  • LDAPsearch — Query LDAP directories
  • Netcat (nc) — Banner grabbing and manual service interactiom
  • WhatWeb — Web technology fingerprinting
  • Wfuzz — Parameter and content enumeration
  • Hydra — Login enumeration and password auditing (when authorized)

The information gathered during this phase identifies potential entry points into the target environment. These findings are then used in the next phase, Exploitation, where validated vulnerabilities are leveraged to gain authorized access to the target system.

Phase 3: Exploitation (Gaining Access)

Exploitation is the phase where the penetration tester attempts to exploit the vulnerabilities identified during scanning and enumeration to gain authorized access to the target system. The objective is to verify whether the discovered vulnerabilities are truly exploitable and to demonstrate their potential impact without causing damage to the system.

None

Information Obtained

  • Initial user access
  • Administrator or root privileges (if achieved)
  • Sensitive files and directories
  • Database contents
  • Password hashes
  • API keys and access tokens
  • Internal applications and services
  • Evidence of successful exploitation

Common Tools

  • Metasploit Framework — Exploit known vulnerabilities
  • Burp Suite — Exploit web application vulnerabilities
  • SQLMap — Exploit SQL Injection
  • Hydra — Password auditing and brute-force testing
  • John the Ripper / Hashcat — Password hash cracking
  • Netcat (nc) — Reverse shells and manual exploitation
  • Impacket — Windows protocol exploitation
  • Responder — Capture NTLM hashes
  • Evil-WinRM — Remote PowerShell access
  • Searchsploit / Exploit-DB — Search public exploits

The successful exploitation of a vulnerability confirms its severity and provides evidence of the potential impact on the target environment. The results of this phase lead to Post-Exploitation, where the tester evaluates the extent of access and overall business impact.

Common Vulnerabilities Exploited

  • SQL Injection (SQLi)
  • Cross-Site Scripting (XSS)
  • Remote Code Execution (RCE)
  • Command Injection
  • File Inclusion (LFI/RFI)
  • File Upload Vulnerabilities
  • Authentication Bypass
  • Weak Passwords
  • Default Credentials
  • Misconfigured Services
  • SMB Vulnerabilities
  • FTP Anonymous Login
  • Outdated Software

Phase 4: Post-Exploitation (Maintaining Access & Assessing Impact)

Post-Exploitation begins after successfully gaining access to the target system. The objective is to assess the impact of the compromise by determining whether privileges can be escalated, sensitive information can be accessed, or additional systems can be reached. This phase helps organizations understand the potential consequences of a real-world attack.

None

Information Obtained During Post-Exploitation

  • Administrator or Root privileges
  • User accounts and groups
  • Password hashes
  • Sensitive files and documents
  • API keys and secrets
  • Internal network structure
  • Shared folders
  • Domain information
  • Database contents
  • Business impact evidence

Common tools:

  • Mimikatz — Credential and password hash extraction
  • BloodHound — Active Directory attack path analysis
  • Impacket — Windows protocol interaction and lateral movement
  • CrackMapExec (NetExec) — Network enumeration and lateral movement
  • PsExec — Remote command execution
  • Evil-WinRM — Remote PowerShell access
  • LinPEAS / WinPEAS — Privilege escalation auditing
  • Linux Exploit Suggester — Linux privilege escalation checks
  • Seatbelt — Windows security enumeration
  • LaZagne — Recover stored credentials
  • PowerView — Active Directory enumeration
  • Netcat (nc) — Remote shell interaction
| Tool                        | Purpose                                           |
| --------------------------- | ------------------------------------------------- |
| **Mimikatz**                | Extract Windows credentials and password hashes   |
| **Impacket**                | Lateral movement and Windows protocol interaction |
| **BloodHound**              | Analyze Active Directory attack paths             |
| **CrackMapExec (NetExec)**  | Network enumeration and lateral movement          |
| **PsExec**                  | Remote command execution on Windows               |
| **Evil-WinRM**              | Remote PowerShell access                          |
| **LinPEAS**                 | Linux privilege escalation checks                 |
| **WinPEAS**                 | Windows privilege escalation checks               |
| **Linux Exploit Suggester** | Identify Linux privilege escalation opportunities |
| **Seatbelt**                | Windows security enumeration                      |
| **LaZagne**                 | Recover stored passwords                          |
| **Rubeus**                  | Kerberos ticket analysis and attacks              |
| **Netcat (nc)**             | Remote shell interaction                          |
| **PowerView**               | Active Directory enumeration                      |

Phase 5: Reporting (Documentation & Remediation)

Reporting is the final phase of penetration testing, where all findings are documented and presented to the client. The objective is to clearly explain the discovered vulnerabilities, demonstrate their impact with evidence, assess the associated risks, and provide practical remediation recommendations.

Information Included

  • Executive summary
  • Scope and methodology
  • Vulnerabilities identified
  • Severity ratings
  • Proof of concept (PoC)
  • Screenshots and evidence
  • Business impact
  • Risk assessment
  • Remediation recommendations

The reporting phase transforms technical findings into actionable recommendations, enabling organizations to understand their security risks and prioritize remediation efforts. A clear and well-structured report is the most valuable deliverable of any penetration test.

Conclusion

Penetration testing is a systematic approach to identifying and validating security vulnerabilities before attackers can exploit them. By following the five phases — Planning & Reconnaissance, Scanning & Enumeration, Exploitation, Post-Exploitation, and Reporting — security professionals can effectively assess an organization's security posture, measure the impact of vulnerabilities, and provide actionable recommendations to strengthen overall cybersecurity.

Thank you!