Penetration testing methodology in Cybersecurity - Mini Project: Build & Apply

Penetration Testing Methodology

📖 Scenario: You are part of a cybersecurity team tasked with assessing the security of a company's computer systems. To do this effectively, you need to follow a clear and organized penetration testing methodology.

🎯 Goal: Build a step-by-step outline of the penetration testing methodology by creating a list of its main phases in order.

📋 What You'll Learn

Create a list called penetration_testing_phases with the exact five phases in order

Create a variable called current_phase_index and set it to 0 to track progress

Use a for loop with variables index and phase to iterate over penetration_testing_phases with enumerate()

Add a final step that sets a variable methodology_complete to True indicating the process is done

💡 Why This Matters

🌍 Real World

Penetration testers follow this methodology to systematically find and report security weaknesses in computer systems.

💼 Career

Understanding and applying this methodology is essential for cybersecurity professionals working in ethical hacking and security assessment roles.

1

DATA SETUP: Create the list of penetration testing phases

Create a list called penetration_testing_phases with these exact phases in order: 'Planning and Preparation', 'Information Gathering', 'Vulnerability Analysis', 'Exploitation', 'Reporting'.

Cybersecurity

# Create the list penetration_testing_phases with the five phases in order
# Your code here

Hint

Use square brackets [] to create a list and separate each phase with commas.

2

CONFIGURATION: Add a variable to track the current phase

Create a variable called current_phase_index and set it to 0 to represent the first phase in the list.

Cybersecurity

penetration_testing_phases = ['Planning and Preparation', 'Information Gathering', 'Vulnerability Analysis', 'Exploitation', 'Reporting']
# Create current_phase_index and set it to 0
# Your code here

Hint

This variable will help keep track of which phase is currently being worked on.

3

CORE LOGIC: Loop through the phases with index and name

Use a for loop with variables index and phase to iterate over penetration_testing_phases using enumerate().

Cybersecurity

penetration_testing_phases = ['Planning and Preparation', 'Information Gathering', 'Vulnerability Analysis', 'Exploitation', 'Reporting']
current_phase_index = 0
# Use a for loop with index and phase to iterate over penetration_testing_phases
# Your code here

Hint

The enumerate() function gives both the position and the item from the list.

4

COMPLETION: Mark the methodology as complete

After the loop, create a variable called methodology_complete and set it to True to indicate the penetration testing process is finished.

Cybersecurity

penetration_testing_phases = ['Planning and Preparation', 'Information Gathering', 'Vulnerability Analysis', 'Exploitation', 'Reporting']
current_phase_index = 0
for index, phase in enumerate(penetration_testing_phases):
    pass
# Set methodology_complete to True
# Your code here

Hint

This variable shows that all phases have been considered.

Practice

1. What is the first step in the penetration testing methodology?

easy

A. Cleaning up after testing

B. Planning and information gathering

C. Reporting findings

D. Exploiting vulnerabilities

Solution

1. Step 1: Understand the methodology sequence

   The penetration testing methodology starts with planning and gathering information about the target system.

2. Step 2: Identify the first step in the process

   Before any testing or exploitation, testers must plan and collect data to know what to test.

3. Final Answer:

   Planning and information gathering -> Option B

4. Quick Check:

   First step = Planning and information gathering [OK]

Hint: Remember: Plan first, then test, then report [OK]

Common Mistakes:

• Starting with exploitation before planning
• Reporting before testing
• Skipping cleanup step

2. Which of the following is the correct order of steps in penetration testing?

easy

A. Exploitation, Planning, Reporting, Cleanup

B. Reporting, Exploitation, Scanning, Planning

C. Planning, Scanning, Exploitation, Reporting

D. Cleanup, Reporting, Exploitation, Scanning

Solution

1. Step 1: Recall the standard penetration testing phases

   The typical order is Planning, Scanning (information gathering), Exploitation (attacking), then Reporting.

2. Step 2: Match the correct sequence

   Planning, Scanning, Exploitation, Reporting correctly lists the steps in the right order.

3. Final Answer:

   Planning, Scanning, Exploitation, Reporting -> Option C

4. Quick Check:

   Correct order = Planning, Scanning, Exploitation, Reporting [OK]

Hint: Think: Plan, scan, attack, then report [OK]

Common Mistakes:

• Mixing up the order of steps
• Starting with exploitation
• Reporting before testing

3. During a penetration test, a tester runs a scan and finds open ports 22 and 80. What is the next logical step?

medium

A. Ignore the ports and scan again

B. Report the open ports immediately

C. Clean up the system

D. Exploit vulnerabilities on services running on ports 22 and 80

Solution

1. Step 1: Understand the scanning results

   Open ports 22 (SSH) and 80 (HTTP) indicate services that can be tested for weaknesses.

2. Step 2: Decide the next step in methodology

   After scanning, the next step is exploitation, trying to find and use vulnerabilities on those services.

3. Final Answer:

   Exploit vulnerabilities on services running on ports 22 and 80 -> Option D

4. Quick Check:

   Scan -> Exploit next [OK]

Hint: Scan finds targets, next step is to test them [OK]

Common Mistakes:

• Reporting before exploitation
• Skipping exploitation step
• Ignoring open ports

4. A penetration tester forgot to clean up after testing and left test accounts active. What is the main issue with this?

medium

A. It violates the cleanup phase and may leave security risks

B. It improves system security

C. It speeds up the reporting process

D. It is part of the exploitation phase

Solution

1. Step 1: Identify the cleanup phase purpose

   The cleanup phase ensures no test artifacts or accounts remain that could be exploited later.

2. Step 2: Understand consequences of skipping cleanup

   Leaving test accounts active creates security risks and violates best practices.

3. Final Answer:

   It violates the cleanup phase and may leave security risks -> Option A

4. Quick Check:

   Cleanup prevents leftover risks [OK]

Hint: Always clean up to avoid leaving security holes [OK]

Common Mistakes:

• Thinking leftover accounts improve security
• Confusing cleanup with reporting
• Ignoring cleanup importance

5. A penetration tester finds a vulnerability during exploitation but decides not to report it because it seems minor. What is the best practice according to penetration testing methodology?

hard

A. Report all vulnerabilities found, regardless of severity

B. Only report vulnerabilities that are easy to exploit

C. Ignore minor vulnerabilities to save time

D. Report vulnerabilities only if the client asks

Solution

1. Step 1: Understand reporting responsibilities

   Penetration testing methodology requires reporting all findings to give a full security picture.

2. Step 2: Evaluate the options

   Ignoring minor vulnerabilities is not best practice; all should be reported for client awareness.

3. Final Answer:

   Report all vulnerabilities found, regardless of severity -> Option A

4. Quick Check:

   Report all findings for full transparency [OK]

Hint: Always report every vulnerability found [OK]

Common Mistakes:

• Ignoring minor issues
• Reporting only major vulnerabilities
• Waiting for client to ask