Foundations & Mindset

The Pentest Methodology (Your Repeatable Process)

The 5-phase loop every engagement follows, from recon to reporting.

Beginner · 12 min

Open the interactive lesson →

Beginners jump straight to 'attacking'. Professionals follow a repeatable process so nothing is missed. Memorize these five phases — every module in HackPath maps onto one of them.

1. Reconnaissance — gather information about the target (domains, IPs, tech stack, people).
2. Scanning & Enumeration — actively map open ports, services, and application features.
3. Exploitation — abuse a specific weakness to gain access or extract data.
4. Post-Exploitation — escalate privileges, move laterally, and assess real impact.
5. Reporting — document findings, evidence, risk, and remediation.

It's a loop, not a line

Post-exploitation often reveals a new internal network, which sends you back to recon. Real engagements cycle through these phases many times.

Take the quiz →