What is it?
Penetration testing follows a consistent phase sequence: Reconnaissance (gathering information), Scanning (finding live hosts and open ports), Enumeration (extracting detail from what scanning found), Vulnerability Assessment (matching findings to known weaknesses), Exploitation (proving a vulnerability is real, within scope), and Reporting (documenting impact and remediation). The tools used within each phase vary; the phase sequence itself does not.
Why should I learn it?
Interviewers frequently ask you to walk through this sequence, and it’s the mental model every later topic in this section slots into — recon, scanning, enumeration and web security are each one phase of this same pipeline.
How it works
Recon builds a target picture without necessarily touching systems directly → scanning identifies what’s actually live and reachable → enumeration digs into service detail (versions, shares, usernames) → vulnerability assessment matches that detail against known weaknesses → exploitation demonstrates real risk within the agreed scope → reporting turns findings into fixable, prioritised recommendations.
Real-world example
Skipping straight to exploitation without proper recon and enumeration is how testers miss context — an exploitable service might be irrelevant if it’s isolated on a segment with no path to anything sensitive. Doing the earlier phases properly is what turns “I found a vulnerability” into “here’s the actual risk this creates.”
Troubleshooting mindset
If an engagement feels stuck, check which phase you’re actually in — jumping to exploitation too early is the most common reason beginners get incomplete or misleading results.
Common mistake
Do not memorise the definition without connecting it to real engagement practice. Ask: what does this concept mean for what I’m allowed to actually do, and how would I prove I stayed within scope?
Quick recap
- Understand the job of the phase or technique.
- Know where it sits in the overall testing methodology.
- Always tie it back to authorization and scope.
- Connect the topic to the next phase of the engagement.
Interview connection
Explain the concept in simple words first, then connect it to authorization and real engagement practice. That is stronger than repeating a tool name.
References & Further Reading
- AddySec original content — written for the Ethical Hacking track to build practical, interview-ready understanding.
Apni Bhasha mein samjho
Recon → Scan → Enumerate → Exploit (scope ke andar) → Report. Ye order fixed hai — exploitation se pehle recon aur enumeration skip mat karo.
Kaise padho?
Concept ko pehle flow ke saath samjho. Phir English note ke technical terms, commands aur tables dekho — technical terminology same rahegi.