Our general approach during penetration tests is as follows:

1. Reconnaissance
   We attempt to gather as much information as possible about the target. Reconnaissance can take two forms: active and passive. A passive attack is always the best starting point as this would normally defeat intrusion detection systems and other forms of protection, etc., afforded to the network. This usually involves trying to discover publicly available information by utilizing a web browser, visiting newsgroups, etc. An active form would be more intrusive and may show up in audit logs and may take the form of a social engineering type of attack.
2. Enumeration
   We use various fingerprinting tools to determine what hosts are visible on the target network and, more importantly, try to ascertain what services and operating systems they are running. Visible services are researched further to tailor subsequent tests to match.
3. Scanning
   Vulnerability scanners are used to scan all discovered hosts for known vulnerabilities or weaknesses. The results are analyzed to determine if there are any vulnerabilities that could be exploited to gain access or enhance privileges to target hosts.
4. Obtaining Access
   We use the results of the scans to assist in attempting to obtain access to target systems and services, or to escalate privileges where access has been obtained (either legitimately though provided credentials, or via vulnerabilities). This may be done surreptitiously (for example to try to evade intrusion detection systems or rate limits) or by more aggressive brute-force methods.

Throughout the report, vulnerabilities or risks are labeled and categorized according to the Penetration Testing Execution Standard (PTES). For more information, see: http://www.pentest-standard.org/index.php/Reporting

These categories are:

• Extreme
  Extreme risk of security controls being compromised with the possibility of catastrophic financial/reputational losses occurring as a result.
• High
  High risk of security controls being compromised with the potential for significant financial/reputational losses occurring as a result.
• Elevated
  Elevated risk of security controls being compromised with the potential for material financial/reputational losses occurring as a result.
• Moderate
  Moderate risk of security controls being compromised with the potential for limited financial/reputational losses occurring as a result.
• Low
  Low risk of security controls being compromised with measurable negative impacts as a result.