From Nmap Scan to Exploitation: How a Pentest Actually Works

When I first started learning penetration testing, I thought it was simply about running Kali Linux, finding a vulnerability, and exploiting it.

I quickly realized it was much more than that.

A penetration test is a structured process where each step helps you understand the target better.

Reconnaissance → Scanning → Enumeration → Vulnerability Identification → Exploitation → Reporting

Here's what that looks like.

1. Reconnaissance

The first step is gathering information about the target.

This could include IP addresses, domains, technologies, and publicly exposed services.

The goal is simple: understand the attack surface before testing it.

2. Scanning

Next comes scanning.

One of the most commonly used tools for this is Nmap. It can help identify live hosts, open ports, and services running on a system.

For example, a scan might reveal:

21/tcp   open   ftp
22/tcp   open   ssh
80/tcp   open   http

21/tcp   open   ftp
22/tcp   open   ssh
80/tcp   open   http

At this point, you haven't exploited anything.

You've simply discovered possible entry points.

3. Enumeration

Now we dig deeper.

If Nmap shows that FTP is running, for example, we want to know:

• What software is being used?
• What version is it?
• Is it misconfigured?
• Are there known vulnerabilities?

Enumeration helps turn basic scan results into useful information.

4. Vulnerability Identification

After gathering information, we look for weaknesses.

This could be an outdated service, weak configuration, insecure authentication, or a vulnerable web application.

It's important to remember:

Finding a vulnerability doesn't automatically mean exploitation will succeed.

That's something I've learned while practicing in cybersecurity labs.

5. Exploitation

Now we test whether the vulnerability can actually be abused.

Tools such as Metasploit can be used in authorized environments to test known vulnerabilities.

Sometimes it works.

Sometimes it doesn't.

And that's okay.

A failed exploit can still teach you something about the target, your configuration, or the exploit itself.

6. Reporting

The final step is documenting what you found.

A good penetration test should explain:

• What vulnerability was discovered
• Where it was found
• How it was identified
• What impact it could have
• How it can be fixed

The goal isn't just to "hack" a system.

The goal is to help an organization understand and reduce its security risks.

My Final Thoughts

One of the biggest lessons I've learned while studying penetration testing is that the tools are only part of the process.

Nmap can give you information.

Metasploit can help test an exploit.

But you need to understand what the results mean.

A good pentester isn't just someone who can run commands. They're someone who can investigate a system, identify weaknesses, demonstrate their impact responsibly, and communicate how those weaknesses can be fixed.

And that's the skill I'm working toward.