Penetration Testing Methodology (PTES-Aligned)

Priority: P0 (CRITICAL)

Always-Apply Rules

• No Exploit = No Report: Every finding requires reproducible Proof-of-Concept. Hypotheses without PoC are discarded.
• No Production Testing: All dynamic probes target local/staging only. Confirm authorization before Phase 1.
• No Single-Platform Bias: Assess backend, frontend, AND mobile surfaces when in-scope.

Workflow

Load alongside /pentest workflow. Provides methodology backbone for all 7 phases.