Penetration testing is a structured security assessment process that simulates real-world cyberattacks to identify vulnerabilities before malicious actors can exploit them. Operating within legal authorization and ethical frameworks, penetration testers use reconnaissance, scanning, exploitation, post-exploitation, and reporting phases to validate security controls across networks, web applications, cloud environments, and endpoints. The practice has expanded significantly with cloud infrastructure, containerized workloads, API-driven architectures, and AI systems, requiring testers to master not only traditional network exploitation but also modern cloud-native and LLM-specific attack surfaces. Understanding the difference between vulnerability scanning and actual exploitation is crucial — pentesting validates real-world impact, confirms exploitability, and demonstrates how an attacker could chain multiple weaknesses to achieve objectives like data exfiltration or privilege escalation.
What This Cheat Sheet Covers
This topic spans 20 focused tables and 225 indexed concepts, 149 flashcards, 6 practice tests with 225 questions. Below is a complete table-by-table outline of this topic, spanning foundational concepts through advanced details.
A jump-to index of every table row in this cheat sheet.
An interactive map of every table and concept in this topic.
Table 1: Penetration Testing Methodologies
Established frameworks give structure to what would otherwise be an ad-hoc process, ensuring consistent coverage and defensible methodology when findings are reviewed by clients or auditors. Choosing the right framework, or combining elements of several, shapes the entire engagement from scoping to final report.
| Framework | Example | Description | |
|---|---|---|---|
Seven phases: Pre-engagement → Intelligence Gathering → Threat Modeling → Vulnerability Analysis → Exploitation → Post-Exploitation → Reporting | Community-driven standard defining a comprehensive penetration testing workflow with technical guidelines for each phase. | ||
Web application-specific methodology covering authentication, session management, input validation, business logic flaws | • Focused specifically on web application security, unlike broader frameworks such as PTES or NIST SP 800-115 • provides detailed testing procedures for each OWASP Top 10 vulnerability type | ||
Tactics (unordered, not a strict sequence): Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Stealth, Defense Impairment, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Impact | • Knowledge base of real-world adversary tactics and techniques, not a step-by-step testing methodology • use to structure threat-informed tests and red team operations; MITRE's own FAQ notes tactics are unordered since adversary goals shift during an operation, unlike an ordered model like the Cyber Kill Chain • the April 2026 (v19) release split the old Defense Evasion tactic into Stealth and Defense Impairment | ||
Technical Guide to Information Security Testing and Assessment; covers network, application, and wireless testing | • U.S. government standard providing comprehensive technical guidance on planning, conducting, and reporting security assessments • distinct from the NIST Cybersecurity Framework (CSF), which is a broader risk-management framework rather than a technical testing procedure | ||
Methodology covering human security, physical, wireless, telecommunications, data networks, and SCADA | • Scientific approach with a quantifiable rav score of the attack surface, calculated from measurable operational factors instead of subjective risk assumptions • focuses on operational security rather than theoretical vulnerabilities | ||
Requirements for testing cardholder data environments (CDE); segmentation validation and critical asset testing | • Mandatory for payment card industry compliance • defines minimum scope and frequency for penetration tests, scoped around the cardholder data environment rather than the whole IT estate | ||
Risk categories: Insufficient Flow Control Mechanisms, Inadequate Identity and Access Management, Dependency Chain Abuse, Poisoned Pipeline Execution (PPE), Insufficient PBAC, Insufficient Credential Hygiene, Insecure System Configuration, Ungoverned Usage of 3rd Party Services, Improper Artifact Integrity Validation, Insufficient Logging and Visibility | • Framework classifying the top supply chain and CI/CD security risks, distinct from the OWASP Top 10 for already-deployed web applications • essential for modern DevOps penetration testing |