Penetration Test Engagement Methodology

Work through a structured, repeatable methodology for authorized penetration tests.

When to Use

• You are planning or executing a penetration test with written authorization
• You need to ensure coverage and consistency across an engagement
• You are preparing deliverables for a client or internal stakeholder

Hard Rules

1. Never test without written authorization. Verify the scope statement, rules of engagement (RoE), and emergency contacts before touching anything.
2. Stay in scope. Check every IP, domain, and URL against the scope document before testing. If unsure, ask — do not guess.
3. No destructive actions unless explicitly authorized: no DoS, no data destruction, no production brute-force lockouts.

Phases

1. Scoping and Planning