SUNANDO ROY – On Banking, Finance and Society

Penetration testing is typically divided into distinct phases, each designed to simulate different stages of an attack. Here’s an overview of these segments, along with prominent tools used in each phase:

1. Footprinting

Footprinting is the initial phase where testers gather as much information as possible about the target system or organization. Key Activities during footprinting  include:  collecting public information (e.g., domain names, IP addresses, WHOIS data), identifying target networks, services, and potential vulnerabilities and mapping the organization’s attack surface. For footprinting , the typical Hacker’s Toolkit ( also used by Pentesters) include :

• Maltego: For open-source intelligence (OSINT) and data aggregation.
• Recon-ng: A reconnaissance framework for gathering data on domains, hosts, and networks.
• theHarvester: A tool for gathering email addresses, subdomains, and metadata from public sources.
• Shodan: A search engine for locating exposed devices and services.
• Google Dorks: Using advanced search queries to find sensitive information indexed by search engines.

2. Scanning and Enumeration

This phase involves actively probing the target system to identify live hosts, open ports, services, and detailed system information. In this phase, major  efforts are spent on identifying open ports and running services, enumerating usernames, shares, and network details and analyzing service versions and configurations.

Hacker’s Toolkit for This phase:

• Nmap: For network discovery and port scanning.
• Nessus: A vulnerability scanner for identifying flaws in networks and applications.
• Netcat: For banner grabbing and establishing connections to test services.
• Nikto: A web server scanner for identifying vulnerabilities.
• Enum4linux: For enumerating SMB shares, usernames, and groups.

3. Vulnerability Discovery

In this phase, testers identify specific vulnerabilities in systems, applications, or configurations that can be exploited.Key Activities during this phase encompass  validating open ports, services, and their associated vulnerabilities, identifying outdated software, misconfigurations, and unpatched systems and prioritizing vulnerabilities for exploitation based on risk and impact.

Hacking  Tools

• OpenVAS: An open-source vulnerability scanning tool.
• Burp Suite: For web application security testing, including vulnerability analysis.
• Metasploit Framework: A tool for identifying and exploiting vulnerabilities.
• OWASP ZAP: An open-source tool for detecting vulnerabilities in web applications.
• QualysGuard: A cloud-based vulnerability management tool.

4. System Exploiting

In this phase, testers exploit the identified vulnerabilities to gain unauthorized access, escalate privileges, or simulate malicious actions.Activities in this phase include gaining access to systems or applications.Escalating privileges to increase the tester’s level of control.Maintaining persistence for further exploitation or deeper testing.

Hackers’ ( and Pentesters’) Tools

• Metasploit Framework: A comprehensive tool for exploiting vulnerabilities.
• Cobalt Strike: A threat emulation tool used for post-exploitation.
• Exploit-db: A repository of known exploits and vulnerabilities.
• Hydra: For brute-force attacks on services like SSH, RDP, or HTTP.
• John the Ripper: For password cracking and hash decryption.

Beyond this, there are certain post exploitation tools   like Mimikatz (for credential dumping) and Empire (for persistence) are used in post-exploitation.

It may be noted ( which I have described in a separate blog) , DDoS Tools  are avoided in Pen tests for valid reasons.  Tools like LOIC or HOIC are used for DDoS but are typically excluded from penetration testing due to ethical and operational risks.

These tools, which are essentials in a Hacker’s toolkit,  help penetration testers uncover vulnerabilities effectively while adhering to the scope and ethical boundaries defined by the engagement.