Authorization, Methodology & Test Types

Authorization Is the Line

Penetration testing is an authorized, simulated attack to find exploitable vulnerabilities before a real attacker does. Explicit authorization is essential — the exact same technical actions are either legitimate security testing or criminal computer intrusion depending on whether proper permission exists. A rules of engagement document formalizes scope, authorized techniques, timing, and emergency stop procedures before any testing begins.

Black Box, White Box, Gray Box

These describe how much internal knowledge the tester starts with: black box (none — simulating an outside attacker), white box (full internal access/documentation — simulating a well-informed insider), gray box (partial knowledge, in between).

The Standard Phases

Reconnaissance gathers information about the target (exposed services, tech stack) before any exploitation attempt — mirroring what a real attacker does first. Vulnerability scanning uses automated tools to surface candidate weaknesses, which inevitably include false positives — findings that aren't actually real or exploitable, requiring manual verification. Exploitation is where a tester actually attempts to leverage a candidate vulnerability, confirming real impact rather than just theoretical presence.

Post-Exploitation: Escalation & Lateral Movement

Privilege escalation expands an initial foothold (a low-privilege account) toward broader access (admin/root). Lateral movement simulates spreading from one compromised system to others on the same network — reflecting how real breaches often unfold well beyond the first compromised machine.