Inside a Penetration Test: From First Scan to Final Report

Fire up a deliberately vulnerable machine on a platform like TryHackMe or HackTheBox, or a local box like Metasploitable, and you've got everything you need to run a real penetration test end to end without breaking a single law. That distinction matters more than it sounds: every technique below assumes you're testing a system you own, or one you're explicitly authorized to test, whether that's a training lab or a signed client engagement. Point any of it at infrastructure you don't have permission to touch and the "ethical" half of ethical hacking stops applying.

Reconnaissance: Before You Touch Anything

A test starts with looking, not attacking. Passive recon pulls whatever is publicly visible, DNS records, WHOIS data, job postings that accidentally reveal a company's tech stack, without sending a single packet at the target. Active recon is where tools like Nmap come in: scanning for open ports, fingerprinting which services are running behind them, and building a map of what's actually reachable. Skip this step or rush it and everything downstream gets built on guesses instead of evidence.

Scanning and Enumeration: Turning Ports Into a Plan

An open port is a question, not an answer. Enumeration is the work of turning "port 445 is open" into "this is Samba 4.6.2, and here's what's known to be wrong with that version." Testers dig into service banners, software versions, and misconfigurations, cross-referencing what they find against public vulnerability databases. Most of a test's actual time goes here, not in the exploitation everyone associates with hacking.

Exploitation Isn't the Whole Job, Even Though It Gets All the Attention

This is the part beginner tutorials tend to linger on and real engagements treat as one step among five. Exploitation means taking a specific, identified weakness and using it to gain access, sometimes through a framework like Metasploit, sometimes through a manually adapted proof-of-concept, sometimes just a default credential nobody rotated. It's worth knowing that this step has gotten more central to how breaches actually happen: Verizon's 2026 Data Breach Investigations Report found vulnerability exploitation is now the single most common way attackers get in, at 31% of breaches, up from 20% the year before. Median time to patch a known vulnerability climbed from 32 to 43 days over the same period. Defenders are getting slower while attackers automate faster, and that gap is exactly what a penetration test is supposed to surface before someone outside the company finds it first.

Privilege Escalation: From "A Foothold" to "Root"

Initial access rarely hands over the keys to everything. A compromised low-privilege account might read a handful of files and not much else. Privilege escalation is the process of climbing from that limited foothold to full administrative or root control, through misconfigured file permissions, unpatched local exploits, credentials cached somewhere they shouldn't be, or a service running with more trust than it needs. It's frequently the phase that separates "we found a weakness" from "we could have taken over the entire system," and clients care a great deal about which of those two sentences ends up in the report.

Post-Exploitation and the Report Nobody Talks About

Here's the part almost nobody covers in beginner content: the deliverable a client actually pays for is the report, not the access. Post-exploitation means documenting what was reachable once inside, what data was exposed, and how far the compromise could realistically have spread, then writing all of it up clearly enough that a non-technical stakeholder understands the business risk and an engineer knows exactly what to fix. A tester who can compromise a box but can't explain it in writing hasn't finished the job. This is also the single biggest difference between a certification exam and a paid engagement: OSCP, for instance, requires a full written report as part of passing, precisely because the industry learned the hard way that raw access without documentation is close to worthless to a client.

Demand for this skill set isn't cooling off. The Bureau of Labor Statistics projects 29% growth for information security analyst roles through 2034, roughly ten times the average across all occupations, and Glassdoor puts the 2026 US median penetration tester salary at $155,000.

Running these five phases against a lab box a few times over teaches the discipline far better than reading about them does. SkyTrainings' Cybersecurity program builds toward the CEH exam through exactly this kind of hands-on lab environment. Enroll in the Cybersecurity course.