A repeatable method: PTES and OWASP WSTG

Why method beats poking

A beginner often jumps straight to running tools at random. A professional follows phases, so the test is thorough, repeatable and explainable. If a client asks "did you check for X?", the professional can point to the step. A method also keeps you inside scope and on schedule.

The PTES phases

PTES stands for the Penetration Testing Execution Standard. It lays out the stages of a test in order:

1. Pre-engagement: agree scope and rules of engagement (module 1).
2. Intelligence gathering: reconnaissance — learn about the target.
3. Threat modelling: work out what matters most and how it might be attacked.
4. Vulnerability analysis: find the weaknesses.
5. Exploitation: carefully prove a weakness is real (in scope, authorised).
6. Post-exploitation: assess the impact, still within the rules.
7. Reporting: write up findings, risk and fixes.

OWASP WSTG for web apps

The OWASP Web Security Testing Guide (WSTG) is a free, detailed checklist for testing web applications. It groups tests into areas such as information gathering, authentication, session management, input validation and so on, each with how to test it. When you test a web app, WSTG makes sure you cover every area.

Reporting is a phase, not an afterthought

Notice that reporting is the last and arguably most important phase. A finding that is not written up clearly, with its risk and fix, has little value to the client. Good testers take notes during every phase so the report writes itself at the end. You will cover reporting in depth later.