> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/HackTricks-wiki/hacktricks/llms.txt
> Use this file to discover all available pages before exploring further.

# Pentesting Methodology

> A structured, step-by-step approach to conducting professional penetration tests, from initial access to post-exploitation and pivoting.

## Overview

This methodology provides a systematic framework for penetration testing engagements. Whether you are performing an **internal** or **external** test, following this structured approach ensures thorough coverage and reproducible results.

<Tip>
  If you are performing an external test and manage to obtain access to the internal network, **restart this guide from step 1** with an internal perspective.
</Tip>

## The Methodology

<Steps>
  <Step title="Physical Attacks (Step 0)">
    If you have **physical access** to the target machine, consider physical attack vectors and escaping from GUI applications before moving to network-based testing.
  </Step>

  <Step title="Discover Hosts / Assets (Step 1)">
    Depending on whether you are performing an **internal** or **external** test:

    * **Internal test:** Find hosts inside the company network.
    * **External test:** Find company assets exposed on the internet using [External Recon](/generic-methodologies/external-recon).
  </Step>

  <Step title="Network Fun (Step 2 — Internal Only)">
    Before attacking individual hosts, consider stealing credentials from the network or passively/actively sniffing data (MitM). See [Pentesting Network](/generic-methodologies/pentesting-network).
  </Step>

  <Step title="Port Scan — Service Discovery (Step 3)">
    The first step when looking for vulnerabilities in a host is knowing which **services are running on which ports**. Use tools like `nmap`, `masscan`, and service fingerprinting.

    ```bash theme={null}
    # Fast scan of top 1000 TCP ports
    nmap -sV -sC -O -T4 -n -Pn -oA fastscan <IP>

    # Full port scan
    nmap -sV -sC -O -T4 -n -Pn -p- -oA fullscan <IP>
    ```
  </Step>

  <Step title="Search for Service Version Exploits (Step 4)">
    Once you know which services and versions are running, **search for known vulnerabilities**. A public exploit may give you a shell directly.

    See [Search Exploits](/generic-hacking/search-exploits) for tools and resources.
  </Step>

  <Step title="Pentest Services (Step 5)">
    If no public exploit exists, look for **common misconfigurations** in each running service. This book contains guides for the most common services.

    * **Automatic tools:** Consider [Legion](https://github.com/carlospolop/legion) for automated vulnerability assessment.
    * **Brute-force:** Use the [Brute Force CheatSheet](/generic-hacking/brute-force) when credentials may be weak.
  </Step>

  <Step title="Phishing (Step 6)">
    If no interesting vulnerability is found, [Phishing](/generic-methodologies/phishing-methodology) can be a powerful way to get inside the network or capture credentials.

    **Note:** Be aware of modern AI-assisted tooling vulnerabilities — for example, CVE-2025-61260 allows code execution via malicious MCP server configurations committed to a repo.
  </Step>

  <Step title="Getting a Shell (Step 7)">
    Once you have code execution, use [Reverse Shells](/generic-hacking/reverse-shells) to obtain an interactive shell. On Windows, you may need AV bypass techniques.
  </Step>

  <Step title="Post-Exploitation Commands (Step 8)">
    With a shell, use these key command references:

    * **Linux:** Useful Linux commands for pentesters
    * **Windows CMD:** Basic CMD commands for pentesters
    * **Windows PowerShell:** Basic PowerShell for pentesters
  </Step>

  <Step title="Exfiltration (Step 9)">
    Extract data from the victim or introduce scripts (like privilege escalation tools). See [Exfiltration](/generic-hacking/exfiltration) for common techniques.
  </Step>

  <Step title="Privilege Escalation (Step 10)">
    If you are not root/Administrator, escalate your privileges.

    * **Local PrivEsc:** Linux and Windows local privilege escalation guides.
    * **Domain PrivEsc:** Active Directory methodology for escalating privileges and persisting.
    * **Tool:** Use [PEASS-ng (Suite PEAS)](https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite) to enumerate escalation paths.
  </Step>

  <Step title="Post Exploitation (Step 11)">
    * **Looting:** Search for more passwords, access to other machines, or dump credentials.
    * **Persistence:** Establish 2–3 different persistence mechanisms so you do not need to re-exploit.
  </Step>

  <Step title="Pivoting (Step 12)">
    With gathered credentials, gain access to other machines or scan new internal networks. Use [Tunneling and Port Forwarding](/generic-hacking/tunneling-and-port-forwarding) to move laterally.
  </Step>
</Steps>

## Key Resource Cards

<CardGroup cols={2}>
  <Card title="External Recon" icon="magnifying-glass" href="/generic-methodologies/external-recon">
    Discover company assets, domains, subdomains, and cloud resources before touching any target.
  </Card>

  <Card title="Pentesting Network" icon="network-wired" href="/generic-methodologies/pentesting-network">
    Host discovery, port scanning, sniffing, ARP spoofing, and LAN attacks.
  </Card>

  <Card title="Brute Force CheatSheet" icon="key" href="/generic-hacking/brute-force">
    Brute-force techniques for dozens of services, from SSH to databases.
  </Card>

  <Card title="Reverse Shells" icon="terminal" href="/generic-hacking/reverse-shells">
    Shell generators and techniques for Linux, Windows, and more.
  </Card>

  <Card title="Exfiltration" icon="file-export" href="/generic-hacking/exfiltration">
    Transfer files and data out of compromised environments.
  </Card>

  <Card title="Tunneling & Port Forwarding" icon="arrow-right-arrow-left" href="/generic-hacking/tunneling-and-port-forwarding">
    SSH tunnels, SOCKS proxies, Chisel, Ligolo-ng, and more pivoting tools.
  </Card>
</CardGroup>

## Additional Topics

* **Android Applications** — Mobile pentesting methodology
* **Binary Exploitation** — Basic Linux/Windows exploiting and exploitation tools
* **Crypto Tricks** — ECB, CBC-MAC, Padding Oracle attacks
* **Side-Channel Attacks** on messaging protocols

## References

* [OpenAI Codex CLI: Command Injection via project-local MCP configuration (CVE-2025-61260)](https://research.checkpoint.com/2025/openai-codex-cli-command-injection-vulnerability/)