Penetration Testing and Reporting

Penetration testing (often shortened to pentesting) is a controlled, authorised simulation of a cyber attack against a system, network, or application. The goal is not to cause damage: it is to identify security weaknesses before a real attacker does. In the 312-50 exam, you need to understand not just how to run the test, but how to plan it, execute it properly, document every finding, and clean up afterwards so you leave the environment exactly as you found it.

The entire process follows a standard lifecycle with five phases: Planning, Reconnaissance, Exploitation, Post-Exploitation, and Reporting. Each phase has a specific purpose and set of activities.

Phase 1: Planning. Before you touch a single keyboard, you and the client sign a document called a 'Rules of Engagement' (RoE). This document defines the scope: which IP addresses are you allowed to scan? What time of day? Are you allowed to try social engineering on employees? You also agree on the type of test: Black Box (no prior knowledge), White Box (full access to documentation and source code), or Grey Box (some knowledge, like login credentials but no architecture diagrams). The planning phase also includes getting written authorisation from someone with the legal authority to approve the test. Without this, you are committing a crime.

Phase 2: Reconnaissance. This is the information-gathering stage. You use techniques like footprinting (gathering publicly available info from websites, social media, DNS records) and scanning (using tools like Nmap to discover open ports and running services on the target). The goal is to build a map of the target's attack surface — every possible way someone could try to break in.

Phase 3: Exploitation. Now you try to actually break in. Using the vulnerabilities you discovered during reconnaissance (like an unpatched web server or a weak password), you attempt to gain access. You might use tools like Metasploit to deliver a payload that gives you a shell on the target system. The goal here is to prove that the vulnerability is real and that an attacker could use it to gain a foothold.

Phase 4: Post-Exploitation. Once you have access, you perform activities that simulate what a real attacker would do: privilege escalation (trying to become the administrator/root user), lateral movement (accessing other systems on the network), data exfiltration (proving you could steal sensitive data), and maintaining persistence (creating a backdoor account, though in a real test you would typically only prove this is possible, not actually leave the backdoor). This phase demonstrates the business impact of the initial compromise.

Phase 5: Reporting. This is arguably the most important phase. You produce a penetration testing report that documents everything: the methodology used, the vulnerabilities discovered, the evidence (screenshots, log extracts, packet captures), the risk rating for each finding (using a standard like CVSS — Common Vulnerability Scoring System), and actionable remediation recommendations. The report must be clear enough for a non-technical manager to understand the business risk, but detailed enough for a system administrator to fix each issue.

Post-Test Cleanup. After the report is delivered, you must destroy any credentials, backdoors, or tools you left on the target system. This includes removing user accounts you created, deleting uploaded files, reverting configuration changes, and securely wiping any data you collected from the client's environment. If you forget to clean up, you leave the client more vulnerable than when you started.

Imagine you work as a junior penetration tester for a security consultancy called SafeShield. A mid-sized e-commerce company, ShopFast, hires you to run an external penetration test on their main website and public-facing APIs. The goal is to find out whether an attacker could steal customer credit card data.

First, you attend a kick-off meeting with ShopFast's IT manager. You sign a Rules of Engagement document that says: test only between 2 AM and 6 AM on Saturday, do not attempt denial-of-service attacks, and do not social-engineer employees. You also receive a VPN access point for reporting, but no credentials for the target application — this is a Black Box test.

On Saturday at 2 AM, you start reconnaissance. You use Nmap to scan the web server's IP address. You discover ports 80 (HTTP) and 443 (HTTPS) are open, along with port 3306 (MySQL), which should not be exposed to the internet. That is your first finding. You also run a web application scanner called Nikto and discover that the site is running an old version of the Apache web server with a known vulnerability.

At 2:45 AM, you move to exploitation. You find a SQL injection vulnerability in the search box on the product page. You use a tool called SQLmap to extract the database contents, including a table called 'users' that contains email addresses and password hashes. You also find that the password hashes use MD5, a weak algorithm that can be cracked in seconds. You crack a few hashes and prove you could log in as an administrative user.

At 3:30 AM, you escalate privileges. The admin account you cracked has full access to the server's file system. You find a configuration file containing the database connection string with the root password in plain text. You take a screenshot. You then demonstrate lateral movement by using that root password to access the internal database server, which contains a table of customer credit card numbers stored in plain text — a PCI DSS violation.

At 4 AM, you begin cleanup. You delete the SQLmap output files from your local machine, remove any temporary user accounts you created, and verify that the SQL injection payloads you sent did not corrupt any data. You check that the web application is still functioning normally by browsing a few pages. You log out of all sessions and disconnect the VPN.

The next week, you write the report. It includes:

You deliver the report in PDF format and present the executive summary to ShopFast's CTO. You then securely delete all client data from your local drive and close the engagement.