Information Security Handbook

Phases of a penetration test

The penetration testing process is a highly choreographed and repeatable process that provides you with the assurance that you are conducting the necessary activities to perform a quality test.

1. Reconnaissance: In the reconnaissance phase, the penetration tester seeks to gather information about the organization that will allow them to exploit and penetrate the organization's defenses. Types of reconnaissance include:
   • Active: The tester actively gathers data about the organization. An example of active reconnaissance is port scanning, where you are directly interacting with the system that you intend to exploit.
   • Passive: The tester passively gathers data about the organization and does not directly interact with ...