Penetration test phases

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. Which phase of a penetration test comes first?

A Planning: agree the scope and rules

B Scanning: look for open ports

2. A tester looks up a company's public website and staff names, without touching its systems. Which phase is this?

A Reconnaissance

B Gaining access

3. A tester runs a tool to find open ports and services on the target network. Which phase is this?

A Scanning

B Reporting

4. Which order of phases is correct?

A Planning, scanning, reconnaissance, reporting, gaining access, maintaining access

B Planning, reconnaissance, scanning, gaining access, maintaining access, reporting

5. A tester uses a vulnerability found in scanning to log in to a server. Which phase is this?

A Reconnaissance

B Gaining access (exploitation)

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1nmap -sV 192.168.1.10		AThe exploit is run before planning. Scope and written permission must be agreed in the planning phase, before any testing starts.
2whois example.com.au		BScanning phase: probes a target to find open ports and the services running on them
3Gaining access: the tester exploits a weakness found during scanning to get into the system		CReconnaissance phase: gathers public information about the target, such as who owns the domain
4Cleaning up: the tester removes test accounts and files and reverses changes made during the test		Dexploit(target, vulnerability)
5phases = [scanning, planning, reconnaissance, gaining access, reporting]		Edelete_account("test_user")
6run_exploit(target) write_scope_and_permission()		FThe phases are out of order and maintaining access is missing. Planning must come first, then reconnaissance, then scanning.

Definitions

penetration test phases

Fill in the Blanks

Complete each line of code by filling in the missing parts.

1. planning 2. ______________ 3. scanning

2. reconnaissance 3. ________ - find open ports 4. gaining access

4. gaining access - exploit a _____________

4. gaining access 5. __________________ - stay in 6. reporting

5. maintaining access 6. _________ - findings and fixes clean up any changes made during the test

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A 1 planning

B 2 reconnaissance

C 3 reporting

D 4 gaining access

E 5 maintaining access

F 6 reporting

Question 2

A plan: get_written_approval()

B recon: exploit_server(t)

C scan: find_open_ports(t)

Question 3

A 1 plan: agree scope in writing

B 2 recon: look up public info

C 3 scan: crack a password

D 4 gain access: use a weakness

Question 4

A recon(target)

B scan(target)

C gain_access(target)

D plan(scope)

E clean_up(target)

F report(findings)

Question 5

A # Phase 3: scanning

B whois 10.0.0.5

C # lists open ports and services

Answer Key

Penetration test phases

Section A: Quick Questions

A — Planning: agree the scope and rules

A — Reconnaissance

A — Scanning

B — Planning, reconnaissance, scanning, gaining access, maintaining access, reporting

B — Gaining access (exploitation)

Section B: Match the Pairs

nmap -sV 192.168.1.10 → Scanning phase: probes a target to find open ports and the services running on them

whois example.com.au → Reconnaissance phase: gathers public information about the target, such as who owns the domain

Gaining access: the tester exploits a weakness found during scanning to get into the system → exploit(target, vulnerability)

Cleaning up: the tester removes test accounts and files and reverses changes made during the test → delete_account("test_user")

phases = [scanning, planning, reconnaissance, gaining access, reporting] → The phases are out of order and maintaining access is missing. Planning must come first, then reconnaissance, then scanning.

run_exploit(target) write_scope_and_permission() → The exploit is run before planning. Scope and written permission must be agreed in the planning phase, before any testing starts.

Section C: Definitions

penetration test phases — The ordered stages of a penetration test: planning, reconnaissance, scanning, gaining access, maintaining access, then reporting, with clean-up of any changes made.

Section D: Fill in the Blanks

1. planning
2. reconnaissance
3. scanning

2. reconnaissance
3. scanning - find open ports
4. gaining access

4. gaining access - exploit a vulnerability

4. gaining access
5. maintaining access - stay in
6. reporting

5. maintaining access
6. reporting - findings and fixes
clean up any changes made during the test

Section E: Spot the Error

C — Scanning is phase 3. Reporting must come last, after access has been gained and maintained, so line 3 should be '3 scanning'.

B — Reconnaissance only gathers information about the target. Exploiting a server is gaining access, which comes later. Line 2 should be 'recon: search_public_info(t)'.

C — Scanning finds open ports and running services. Cracking a password is an attempt to gain access, which is phase 4. Line 3 should be '3 scan: find open ports'.

D — Planning is the first phase, where scope and permission are agreed. It cannot happen after gaining access. Line 4 should be 'maintain_access(target)'.

B — Scanning uses a tool such as nmap to probe the target for open ports and services. whois only looks up registration details, which is reconnaissance. Line 2 should be 'nmap -sV 10.0.0.5'.