Even though each penetration test is a unique service, every test is characterized by its systematic approach and methodology. The methodology we use consists of the following components.

1. Kick-off

   Depending on the complexity of the penetration test, the kick-off takes place between one month and one week before the agreed implementation period. During this meeting, roadblocks and agreements for successful implementation are evaluated. AWARE7 GmbH’s penetration testers and project management team participate in this meeting. The following stakeholders should participate in the kick-off meeting:
   – All relevant risk or project owners
   – Information security officers
   – Technical personnel with knowledge of the target system

2. Recon

   Reconnaissance, recon, or reconnaissance refers to the work of gathering information before a real attack is carried out. The idea is to collect as much information as possible about the target. To achieve this, many different publicly available sources of information are used. The extracted information often already provides detailed insight into the affected systems.
   
   In a penetration test of Active Directory, for example, this means that the first step is to enumerate all systems that are part of Active Directory. The identification of the systems is carried out in parallel with the identification of the network services using common network scanners such as nmap or massscan.

3. Enumeration und Vulnerability Identification

   In the enumeration phase, passive information gathering, as in the reconnaissance phase, is replaced by active information gathering, thereby further enriching the information collected. In addition, the information from the reconnaissance phase is used to identify potential attack vectors. In the enumeration phase, automated scans are started and a vulnerability assessment is performed on the relevant systems. During the enumeration phase, in the context of an Active Directory penetration test, for example, an investigation of the Active Directory configuration would take place. The pentesters would collect information about groups, users, GPOs (Group Policy Objects), policies, and shares.

4. Exploitation

   In the exploitation phase, penetration testers actively attempt to exploit security vulnerabilities. Exploits are developed, for example, to collect sensitive information or to enable pentesters to compromise a system and manifest themselves on it. For new targets, the reconnaissance and enumeration phases are repeated in order to gather information about these new systems and exploit them. For example, in an Active Directory penetration test, password attacks are carried out on previously collected user accounts in order to take over these accounts. In addition, many other different attacks, such as relay attacks, are also carried out.

5. Post Exploitation 

   In the post-exploitation phase, changes to systems, processes, and users are reversed in collaboration with the respective technical contacts and administrators. Since it cannot be ruled out that system configurations may be manipulated or exploit scripts placed during a penetration test, it is important to ensure that these are deleted and reset after the test.

6. Report

   Documentation is an essential part of every penetration test. During the penetration test, all steps leading to a successful attack are documented in detail. This ensures that everything can be traced in detail after the test. At the end of the penetration test, this documentation serves as the basis for an individual report that makes the test results comprehensible for both technical administration and management. Recommendations for action are an important part of the documentation.