--- title: "Pentest Methodology — Canonical Reference · VORNAC Research" description: "PTES, the craft notes on engagement sequencing, and the web-application methodology variants — consolidated into one navigable reference." url: https://www.vornac.com/en/research/offensive-tradecraft/pentest-methodology-canon lang: en published: 2026-06-02 updated: 2026-06-02 alternate_de: https://www.vornac.com/research/offensive-tradecraft/pentest-methodology-canon --- [Research Index](https://www.vornac.com/en/research) / [1 · Offensive Tradecraft](https://www.vornac.com/en/research/offensive-tradecraft) / Pentest Methodology — Canonical Reference Featured · [1 Offensive Tradecraft](https://www.vornac.com/en/research/offensive-tradecraft) # Pentest Methodology — Canonical Reference. PTES, the craft notes on engagement sequencing, and the web-application methodology variants — consolidated into one navigable reference. ## PTES — the seven phases 1. **Pre-engagement.** Scope, rules of engagement, blackout windows, comms channel, deconfliction process, in-scope and out-of-scope assets in writing. 2. **Intelligence gathering.** Passive OSINT first, then active recon. Hand off to vulnerability analysis only after the attack surface is mapped. 3. **Threat modeling.** Identify the assets that matter to the client and the adversary types that target them. Reject scope items that don't move the needle. 4. **Vulnerability analysis.** Map identified surface to known classes. Triage by impact × exploitability, not by scanner severity. 5. **Exploitation.** Validate findings with the minimum proof of impact that survives the client's review. No client data exfiltrated beyond agreed limits. 6. **Post-exploitation.** Persistence (if scoped), lateral movement, data discovery. Document every step in real time — you will not remember it Friday. 7. **Reporting.** Executive summary first, technical detail second, reproduction steps third. Remediation guidance per finding, not a generic appendix. ## Engagement archetype → method shape - **External black-box.** Heavy on recon and OSINT. Spend 30–40% of budget there. Assume detection. - **Internal assumed-breach.** Skip recon, start with credential plumbing and AD enumeration. `BloodHound` on day one. - **Web-app grey-box.** Walk every authenticated role end to end before probing for vulns. Business logic is the highest-value class. - **Red team / objective-based.** Define detection budget upfront. Every tool choice trades stealth against time. Deconfliction call template must exist before kickoff. ## Day-rhythm of a senior tester - **Morning.** Re-read yesterday's notes. Pick the single most promising thread and pursue it for two hours before context-switching. - **Midday.** Update the running findings log. A finding without a screenshot is a finding that will be argued. - **Afternoon.** Tooling, automation, broad scans that need wall-clock time. Triage results as they land. - **End of day.** Five-line status note to the engagement channel: what was done, what was found, what's blocked, what's next, when next status. **Rule of thumb**If the methodology says one thing and the target says another, the target wins. Tear up the plan and write it again. The methodology is a starting position, not a contract. Domain [1 · Offensive Tradecraft](https://www.vornac.com/en/research/offensive-tradecraft) Tier Featured Engagement phases MethodologyReconReporting Published 2 June 2026 Looking up an acronym? [Open the Glossary](https://www.vornac.com/en/glossary) ## Related notes in this domain - [Featured Comprehensive Pentest Reference](https://www.vornac.com/en/research/offensive-tradecraft/comprehensive-pentest-reference) - [Featured Advanced Penetration Testing & Red Team](https://www.vornac.com/en/research/offensive-tradecraft/advanced-pentest-and-redteam) - [Featured Recon & Discovery](https://www.vornac.com/en/research/offensive-tradecraft/recon-and-discovery) - [Featured Web Server — Attack & Defense](https://www.vornac.com/en/research/offensive-tradecraft/web-server-attack-defense) - [Featured Active Directory Pentest](https://www.vornac.com/en/research/offensive-tradecraft/active-directory-pentest) - [Featured Internal Pivoting & Lateral Movement](https://www.vornac.com/en/research/offensive-tradecraft/internal-pivoting) - [Reference Recon Tooling — Operator Reference](https://www.vornac.com/en/research/offensive-tradecraft/recon-tooling) - [Reference Operator Toolkits — Catalog & Reference](https://www.vornac.com/en/research/offensive-tradecraft/operator-toolkits) - [Reference Automation vs. Manual Testing](https://www.vornac.com/en/research/offensive-tradecraft/automation-vs-manual) - [Background Social Engineering & Phishing](https://www.vornac.com/en/research/offensive-tradecraft/social-engineering-phishing) - [Background Pentester Foundations & CTF Practice](https://www.vornac.com/en/research/offensive-tradecraft/pentester-foundations) [Previous note Comprehensive Pentest Reference](https://www.vornac.com/en/research/offensive-tradecraft/comprehensive-pentest-reference) [Back to domain](https://www.vornac.com/en/research/offensive-tradecraft) [Next note Advanced Penetration Testing & Red Team](https://www.vornac.com/en/research/offensive-tradecraft/advanced-pentest-and-redteam) From reference to evidence ## Run this against your own environment.