Penetration Testing, End to End
A penetration test is authorized, goal-oriented adversary simulation: with written permission and a defined scope, you attack a system the way a real attacker would, then hand back a report the defenders can act on. The value isn't the exploit — it's the evidence and the fix. Automated scanners find known issues; a pentest chains them, adds business context, and answers the question a vulnerability list can't: what could actually happen here?
Authorization first, always
The line between penetration testing and a felony is a signed scope document. Before a single packet: rules of engagement, in-scope targets and explicitly out-of-scope systems, testing windows, data-handling rules, and emergency contacts. No authorization, no test — this is professional and legal bedrock, not paperwork to rush.
The engagement lifecycle
1. Reconnaissance
Map the attack surface. Passive first (OSINT, certificate transparency logs, DNS, public breach data) to avoid touching the target; then active enumeration within scope.
# Subdomain surface from certificate transparency + resolution
subfinder -d target.com -silent | httpx -silent -title -tech-detect
# Service discovery, then targeted follow-up (not one giant noisy scan)
nmap -sS -p- --min-rate 2000 -oA sweep target-host
nmap -sCV -p "$(open_ports_from sweep)" -oA deep target-host2. Vulnerability analysis
Correlate what you found against known weaknesses — but treat scanner output as leads, not findings. The scanner says "outdated library"; the pentester asks "is it reachable, exploitable, and does it matter here?" False positives waste the client's time and your credibility.
3. Exploitation
Prove impact by gaining the access the vulnerability allows — carefully, within scope, avoiding anything that risks availability unless explicitly authorized. Modern web work leans on Burp Suite; infrastructure work on targeted, understood exploits rather than spray-and-pray. The goal is a demonstrated foothold, not maximum carnage.
4. Post-exploitation
This is where a test earns its fee. From the foothold: escalate privileges, move laterally, and pursue the defined objective (domain admin, the customer database, the crown-jewel system). Chaining three "medium" issues into full compromise is the finding that changes budgets — and it's exactly what scanners miss.
5. Reporting
The only deliverable that matters. More below.
6. Retest
Verify the fixes actually closed the holes. A finding isn't resolved until it's confirmed resolved.
The 2026 toolchain, briefly
| Phase | Representative tools |
|---|---|
| Recon | subfinder, amass, httpx, nmap, Shodan |
| Web | Burp Suite, ffuf, nuclei, sqlmap |
| Infra / AD | BloodHound, NetExec (the maintained CrackMapExec successor), Impacket, Responder |
| Exploitation | Metasploit, targeted public PoCs (read before running) |
| Cloud | ScoutSuite, Prowler, Pacu, cloud-native IAM analysis |
Cloud and identity are where the interesting work has moved: misconfigured IAM roles, over-permissioned service accounts, and token theft matter more than a missing patch on a hardened host. AI has entered the toolchain too — accelerating recon and payload crafting — but the judgment about what to chain and what it means remains human.
A finding a scanner can't produce
The reporting difference in one example. A scanner emits three separate rows:
- MEDIUM Password policy allows short passwords
- MEDIUM SMB signing not required on file server
- LOW Service account has local admin on 40 hostsThe pentester writes the story: "Password spraying against the weak policy recovered one help-desk credential. That account could relay to the file server (no SMB signing), where the over-permissioned service account's cached credential was harvested — granting local admin across 40 hosts and a direct path to domain compromise. Individually medium; together, full estate takeover in under an hour." That paragraph gets funded; the three rows get triaged into next quarter.
Writing a report people act on
- Executive summary in business terms — risk to the business, not CVSS trivia. This is the page leadership reads.
- Findings ranked by real risk — likelihood × impact in this environment, not the generic score.
- Reproduction steps — enough for the team to see it themselves; evidence, not assertion.
- Concrete remediation — specific fixes with effort estimates, prioritized. "Enable SMB signing via GPO" beats "improve security posture."
- A retest offer. Findings closed and confirmed are the actual product.
A penetration test converts a list of weaknesses into a story of consequences. The exploit is the easy part; the authorization, the chaining, and the report a defender can act on are the profession.