Penetration testing simulates a real attack on your infrastructure. It finds vulnerabilities before an attacker does.

Methodology¶

1. Reconnaissance — information gathering
2. Scanning — identifying services and vulnerabilities
3. Exploitation — attempting to exploit
4. Post-exploitation — lateral movement
5. Reporting — documenting findings

Reconnaissance¶

Passive recon¶

whois example.com dig example.com ANY subfinder -d example.com theHarvester -d example.com -b google

Active scanning¶

nmap -sV -sC -O -p- target.com nikto -h https://target.com

Tools¶

• Nmap: Port scanning, service detection
• Burp Suite: Web app testing
• Metasploit: Exploitation framework
• SQLMap: SQL injection automation
• Nuclei: Vulnerability scanning

Key Takeaway¶

Pentest regularly (at least once a year). Combine automated scanning with manual testing.