Common Penetration Testing Techniques

Key takeaways

• Penetration testing follows authorisation, reconnaissance, scanning, enumeration, exploitation, privilege escalation, lateral movement and reporting.
• Without written permission, the same actions are illegal.
• The report matters as much as the exploit, since it tells the client what to fix first.

Penetration testing follows a repeatable methodology rather than improvisation. This guide walks through the techniques in the order a professional engagement applies them, explains what each stage genuinely achieves, and is explicit about the authorisation rules that separate professional testing from criminal activity.

Table of Contents

1. What Are the Main Penetration Testing Techniques?
2. Before Anything: What Are the Legal Requirements?
3. What Happens During Reconnaissance?
4. How Does Exploitation Actually Work?
5. What Is Privilege Escalation?
6. What Is Lateral Movement and Why Does It Matter?
7. How Is a Penetration Test Reported?
8. What Distinguishes Professional Testing From Tool Running?
9. How Do You Practise These Techniques Legally?

What Are the Main Penetration Testing Techniques?

The core techniques follow a sequence: reconnaissance to gather information, scanning to find live systems and services, enumeration to extract detail, exploitation to gain access, privilege escalation to increase control, lateral movement to reach other systems, and reporting to document everything.

Before Anything: What Are the Legal Requirements?

Every technique described here is lawful only with explicit written authorisation from the system owner, within a defined scope, and for an agreed period. In India, unauthorised access is an offence under the Information Technology Act regardless of intent or whether damage occurred.

A proper engagement begins with a signed scope document specifying which systems may be tested, which techniques are permitted, testing windows, emergency contacts and rules of engagement. That document protects the tester as much as the client.

Anything outside the agreed scope is not testing. Curiosity about an adjacent system, however tempting, is exactly where professional work becomes criminal.

What Happens During Reconnaissance?

Reconnaissance gathers information without touching target systems directly, using public sources such as domain records, job postings, professional profiles and published documents. It builds the picture that makes later stages efficient and targeted.

Job advertisements are unexpectedly informative, frequently naming the exact technologies and versions an organisation runs. Staff profiles reveal team structure useful for social engineering pretexts, and published documents sometimes contain internal paths and usernames in their metadata.

This is the same discipline as open-source intelligence work more broadly - our enumeration guide covers the transition from passive gathering to active querying.

How Does Exploitation Actually Work?

Exploitation uses a specific weakness identified earlier to gain access, whether a known vulnerability in an outdated component, a misconfiguration, weak credentials or an application flaw. Professional testing prefers the least disruptive route that proves the risk.

An important professional distinction: the objective is demonstrating that access is possible, not causing maximum damage. Testers avoid destructive actions, document exactly what they did, and prefer proof-of-concept over full exploitation where the risk is already demonstrated.

Weak or reused credentials remain among the most common successful routes, which is unglamorous but consistently reflected in real engagement findings.

What Is Privilege Escalation?

Privilege escalation is moving from limited access to higher permissions, either vertically to administrator rights on the same system, or horizontally to another user's access at the same level. It usually exploits misconfiguration, excessive permissions or unpatched local vulnerabilities.

• Vertical escalation - standard user to administrator or root
• Horizontal escalation - accessing another user's data at the same privilege level
• Common routes - misconfigured services, excessive sudo rights, unpatched local flaws, credentials in files

Credentials left in scripts, configuration files and command histories are a persistent finding. Automation that embeds passwords in plain text is convenient to write and equally convenient to exploit.

What Is Lateral Movement and Why Does It Matter?

Lateral movement is using access on one system to reach others, typically by reusing harvested credentials or exploiting trust relationships. It matters because it demonstrates blast radius: what a single compromised workstation actually puts at risk.

This is often the most valuable part of a report for management, because it converts an abstract finding into a concrete statement: compromise of one ordinary user account led to access to a particular sensitive system within a defined number of steps.

It is also why network segmentation matters. Flat networks allow rapid lateral movement; segmented ones force attackers through chokepoints where they can be detected.

How Is a Penetration Test Reported?

The report contains an executive summary in business language, the agreed scope and methodology, each finding with severity, evidence and reproduction steps, and specific remediation guidance. The report is the product the client is buying.

Findings should be prioritised by real risk rather than raw technical severity. A moderate vulnerability on an internet-facing system holding customer data usually warrants attention before a critical one on an isolated internal test machine.

Remediation advice should be specific and achievable. Recommending that an organisation rearchitect its network is technically correct and practically useless; recommending a particular configuration change with a stated effect is actionable.

What Distinguishes Professional Testing From Tool Running?

Methodology, judgement and communication. Anyone can run automated scanners; professionals interpret results in context, validate findings manually, chain issues together to demonstrate genuine risk, and explain the implications clearly to different audiences.

Automated tools produce candidate findings, not conclusions. A scanner flagging an outdated version says nothing about whether the vulnerable function is reachable in this deployment, and reporting unvalidated scanner output as a finding damages professional credibility quickly.

How Do You Practise These Techniques Legally?

Use deliberately vulnerable virtual machines, dedicated legal practice platforms and an isolated home lab you own entirely. Never practise against systems you do not own or lack written permission to test, regardless of how harmless the action seems.

• Isolated lab - practice targets kept entirely off production networks
• Purpose-built targets - intentionally vulnerable systems designed for learning
• Legal platforms - services that explicitly authorise testing of their targets
• Document everything - lab write-ups become the portfolio employers ask for

Familiarity with the standard toolset helps - see our overview of Kali Linux tools for a practical starting point.

Talk to a WebAsha training advisor about batches, syllabus and current fees.

To take this further with guided labs and an instructor, see our hands-on VAPT programme.

Related reading

• Ethical Hacking Laws and Legal Boundaries Explained
• What Is Enumeration in Cyber Security?
• Step-by-Step Guide to Performing Your First Website Pentest | A Beginner’s Tutorial for 2026

Reference

For the authoritative details, see OffSec PEN-200 (OSCP).