Interview Prep
Walk through the steps you would take to perform a penetration test.
A penetration test is a structured methodology used to identify, validate, and exploit vulnerabilities within an organization's digital infrastructure. It is essential for proactively discovering security weaknesses before malicious actors can leverage them for data breaches or system compromise. Professionals perform these assessments during pre-deployment audits, regulatory compliance checks, or after significant architecture changes to ensure defensive postures remain robust.
Phase 1: Reconnaissance and Information Gathering
Reconnaissance is the foundational phase where you map the target environment to understand its attack surface. The objective is to gather as much public-facing data as possible without triggering security alerts. By identifying subdomains, IP ranges, and technology stacks, you build a mental model of the infrastructure. This phase is critical because your strategy for subsequent exploitation relies entirely on the accuracy of this intel. If you miss a hidden admin portal or a misconfigured development server, you lose the opportunity to find the 'weakest link.' We focus on passive collection first to remain stealthy, followed by active discovery. Understanding the target's DNS records, MX entries, and service banners allows us to categorize potential entry points and prioritize where to focus our limited testing resources effectively.
# Using a script to perform DNS enumeration to find subdomains
import socket
target = "example.com"
subdomains = ["dev", "staging", "mail", "vpn"]
for sub in subdomains:
fqdn = f"{sub}.{target}"
try:
# Resolve the domain to check if it exists in the infrastructure
ip = socket.gethostbyname(fqdn)
print(f"Found: {fqdn} at {ip}")
except socket.gaierror:
continue # Skip domains that do not resolvePhase 2: Vulnerability Scanning and Discovery
Once the target footprint is established, we proceed to vulnerability scanning to identify weaknesses within the identified services. This phase transforms raw network visibility into actionable intelligence. We use automated tools to compare service versions against databases of known Common Vulnerabilities and Exposures (CVEs). It is vital to understand that scanning is not exploitation; it is mapping. You must analyze the results to filter out false positives, which can waste valuable time during a live test. By cross-referencing banners with security advisories, you identify outdated software, default credentials, and common misconfigurations like open directories or insecure protocols. This systematic approach ensures that you are not just throwing random payloads, but rather building a targeted plan of attack based on verifiable environmental data.
# Basic TCP port scanner to identify open services for potential vulnerability mapping
import socket
target_ip = "192.168.1.1"
ports = [22, 80, 443, 3306]
for port in ports:
# Initialize socket connection to determine if service is listening
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.settimeout(1)
if sock.connect_ex((target_ip, port)) == 0:
print(f"Port {port} is open - potential entry point.")
sock.close()Phase 3: Exploitation and Access Acquisition
Exploitation is the controlled phase where we attempt to gain unauthorized access by leveraging the vulnerabilities found in the previous steps. This is the moment we test the validity of the security controls in place. We must prioritize precision over volume; a single successful exploit against a high-value target is more valuable than a dozen trivial ones. When executing an exploit, you must consider the stability of the target system to avoid causing a Denial of Service. Understanding how the exploit interacts with memory, authentication mechanisms, or application logic allows you to refine your approach. The goal here is to prove the risk is real while maintaining the integrity of the client's production environment, ensuring we gain enough access to demonstrate the impact without causing operational disruption.
# Simulating a credential brute force check against a target interface
import time
credentials = [("admin", "password123"), ("root", "admin")]
def login_attempt(user, pwd):
# Simulate server response for testing purposes
return user == "admin" and pwd == "password123"
for user, pwd in credentials:
if login_attempt(user, pwd):
print(f"Success: {user}:{pwd} granted access.")
break
time.sleep(0.5) # Throttle to mimic evasion techniquesPhase 4: Post-Exploitation and Lateral Movement
After gaining an initial foothold, the objective shifts to post-exploitation. This phase explores the full extent of the compromise. You want to see how far you can move within the network, what elevated privileges can be acquired, and what sensitive data is accessible from this specific machine. Lateral movement is crucial because the initial access point is rarely the ultimate goal. By inspecting configuration files, environment variables, and active sessions, you uncover the 'keys to the kingdom.' You must meticulously document every movement to demonstrate the potential business impact of the breach. This phase highlights the failure of internal network segmentation and insufficient identity management, providing the client with the most persuasive evidence of the need for improved defense-in-depth strategies.
# Searching for sensitive configuration files on a compromised system
import os
def search_sensitive_data(path):
# Looking for files containing potentially sensitive credentials
for root, dirs, files in os.walk(path):
for file in files:
if "config" in file:
print(f"Sensitive file identified: {os.path.join(root, file)}")
search_sensitive_data("/etc")Phase 5: Reporting and Remediation Planning
Reporting is the final and most impactful phase of the penetration test. All the technical effort spent during the previous stages is moot if the findings are not communicated effectively to stakeholders. A high-quality report must bridge the gap between technical vulnerability findings and business risk. Each finding should include a clear description, the methodology used to confirm it, the potential business impact, and specific, actionable remediation steps. By providing a clear roadmap for mitigation, you empower the client to prioritize their security budget and focus on the most critical risks. You are essentially acting as a translator, turning complex technical flaws into clear business concerns that decision-makers can understand and act upon to improve their overall security posture.
# Generating a structured report template to summarize findings
findings = [{"id": 1, "risk": "High", "desc": "Unauthenticated SQL Injection"}]
def generate_report(data):
print("--- PENETRATION TEST REPORT ---")
for item in data:
# Format findings to show business-level risk clearly
print(f"Finding {item['id']}: [{item['risk']}] - {item['desc']}")
generate_report(findings)Key points
- Reconnaissance defines the target's attack surface and guides all subsequent testing activities.
- Automated vulnerability scanning must be manually verified to eliminate false positives and ensure accuracy.
- Exploitation is a precise, controlled process designed to demonstrate risk without harming the production system.
- Post-exploitation activities uncover the full business impact by demonstrating how attackers move laterally.
- Clear documentation of methodology is essential for reproducibility and auditability during the assessment.
- The reporting phase is the most critical step for delivering business value to stakeholders.
- Remediation guidance must be prioritized based on risk to assist organizations in focusing their security efforts.
- Every phase of the test serves to validate or invalidate the assumed security controls of the client.
Common mistakes
- Mistake: Skipping the scoping and rules of engagement phase. Why it's wrong: Without a defined scope, you risk testing systems you aren't authorized to touch, leading to legal issues. Fix: Always obtain a signed contract detailing the exact systems and assets covered.
- Mistake: Jumping straight into exploitation. Why it's wrong: Rushing to use exploits without proper reconnaissance and vulnerability analysis leads to missed low-hanging fruit and potentially crashing fragile systems. Fix: Follow the phases systematically, prioritizing information gathering first.
- Mistake: Neglecting to document findings during the test. Why it's wrong: Relying on memory often leads to missing key details or evidence required for the final report. Fix: Maintain an ongoing log or screenshot repository throughout every step of the assessment.
- Mistake: Testing in a production environment without caution. Why it's wrong: Aggressive scanning or exploit testing can cause service outages or data corruption in live systems. Fix: Coordinate with the client for maintenance windows or request a staged environment for testing.
- Mistake: Failing to perform post-exploitation cleanup. Why it's wrong: Leaving backdoors, test accounts, or temporary files behind creates new security vulnerabilities for the organization. Fix: Implement a verification step to ensure all test artifacts are removed before the engagement concludes.
Interview questions
What is the primary objective of the reconnaissance phase in a penetration test?
The primary objective of the reconnaissance phase is to gather as much intelligence as possible about the target environment without actively interacting with its defensive systems. We do this because understanding the attack surface—such as domain names, IP ranges, and public-facing infrastructure—allows us to identify potential entry points before we engage. For example, using a tool like `dnsrecon -d target.com` helps map the DNS records, which acts as a foundational map for the entire engagement.
How would you conduct active scanning to identify vulnerabilities after gathering intelligence?
Active scanning involves interacting directly with the target systems to identify live hosts, open ports, and running services. I would typically start with `nmap -sV -sC -T4 [target_ip]` to perform service version detection and execute default scripts. This is critical because it moves beyond reconnaissance to reveal exactly which software versions are running, allowing me to cross-reference them against known vulnerabilities in databases like CVEs. The goal here is to determine what is reachable and potentially misconfigured.
Explain the difference between a credentialed and non-credentialed vulnerability scan.
A non-credentialed scan is an external view, simulating an unauthenticated attacker probing the perimeter for exposed flaws. Conversely, a credentialed scan allows the scanner to log into the system, providing deeper visibility into missing patches, local misconfigurations, and registry settings. Credentialed scans are significantly more accurate because they identify vulnerabilities hidden behind authentication walls. You perform the former to see what the public sees, and the latter to understand internal security posture and hardening effectiveness.
What steps do you take when you discover a potential exploit during the exploitation phase?
Once a vulnerability is identified, I verify it before proceeding to ensure I do not cause service instability. I document the finding, assess the risk, and carefully attempt exploitation in a controlled manner. For instance, if I find a SQL injection point, I might use `sqlmap -u 'http://target.com/page.php?id=1' --dbs` to confirm the injection. I prioritize safety by checking if the payload will disrupt production operations, documenting the entire process to provide a verifiable Proof of Concept for the final reporting phase.
Compare the 'Black Box' testing approach to the 'White Box' testing approach.
A 'Black Box' test simulates an external attacker with zero prior knowledge of the target, providing a realistic assessment of the outer defense perimeter. A 'White Box' test provides the tester with source code, network diagrams, and documentation, allowing for a deep-dive analysis of internal logic and architectural flaws. I prefer White Box for complex application security as it catches flaws that might be missed in Black Box, though Black Box is better for testing the effectiveness of the organization's incident detection capabilities.
Why is the post-exploitation and reporting phase considered the most critical part of a penetration test?
Post-exploitation proves the impact of the breach, such as whether I can escalate privileges or move laterally to sensitive data using techniques like `mimikatz` to dump hashes. However, the reporting phase is the true value-add for the client. Without a clear, actionable report detailing the vulnerabilities, the evidence of exploitation, and—most importantly—the remediation guidance, the security team cannot effectively patch the holes. A great report transforms technical findings into executive-level risk assessments, ensuring the organization improves its long-term security maturity.
Check yourself
1. Why is the 'Reconnaissance' phase considered the foundation of a successful penetration test?
- A.It is the only phase where an attacker can legally use social engineering.
- B.It provides the necessary intelligence to identify potential attack vectors and surface area.
- C.It allows the tester to verify if the client has updated their antivirus software.
- D.It is the phase where all administrative credentials are provided by the client.
Show answer
B. It provides the necessary intelligence to identify potential attack vectors and surface area.
Reconnaissance is vital because it gathers intelligence on the target's infrastructure, which dictates the attack strategy. Option 0 is wrong because social engineering is a technique, not the purpose. Option 2 is wrong because AV checks happen later. Option 3 is wrong because credentials are typically not handed over during recon.
2. What is the primary objective of the 'Vulnerability Analysis' phase?
- A.To physically compromise the server hardware.
- B.To delete all logs that might indicate a test is occurring.
- C.To map discovered vulnerabilities to specific potential exploits or security weaknesses.
- D.To generate the final report for the management board.
Show answer
C. To map discovered vulnerabilities to specific potential exploits or security weaknesses.
The goal is to analyze findings to understand if discovered services are vulnerable. Option 0 is generally out of scope. Option 1 is counterproductive to testing. Option 3 describes the purpose of the Reporting phase, not the analysis phase.
3. In the context of the 'Exploitation' phase, why is a controlled approach preferred over a rapid-fire attempt?
- A.Because controlled exploitation ensures the stability of the target system and minimizes unintended downtime.
- B.Because rapid-fire attempts are always blocked by firewalls and provide no useful data.
- C.Because the law requires penetration testers to wait at least one hour between each exploit attempt.
- D.Because manual exploitation is the only method permitted by industry standards.
Show answer
A. Because controlled exploitation ensures the stability of the target system and minimizes unintended downtime.
Testing must avoid crashing services. Option 1 is false as rapid-fire tools can be configured to bypass some filters. Option 2 is a false legal claim. Option 3 is false as automated tools are a standard component of testing.
4. Which task is most representative of the 'Post-Exploitation' phase?
- A.Configuring the firewall to block incoming traffic from the internet.
- B.Identifying the business value of the data that could have been exfiltrated.
- C.Installing as many tools as possible to ensure future access.
- D.Scanning the network for new devices that were not in the initial scope.
Show answer
B. Identifying the business value of the data that could have been exfiltrated.
Post-exploitation is about understanding the impact and value of the breach. Option 0 is a remediation step. Option 2 is a malicious action, not a professional test requirement. Option 3 is out of scope.
5. Why must a penetration tester perform a 'Cleanup' phase after testing is complete?
- A.To ensure the tester does not get arrested for leaving open ports.
- B.To ensure the target system returns to its original, secure state without lingering test artifacts.
- C.To allow the tester to hide their IP address from the logs.
- D.To generate a list of all successful exploits for the final invoice.
Show answer
B. To ensure the target system returns to its original, secure state without lingering test artifacts.
Cleanup is essential to remove backdoors and accounts created for the test, ensuring the environment remains secure. Option 0 is a fear-based distraction. Option 2 is unethical for a tester. Option 3 is unrelated to professional test requirements.