How a Pen Test Actually Runs: Discovery, Attack, and Leaving No Trace

A real engagement isn't a single shot; NIST frames it as a loop between discovery and attack that you run over and over. You learn something, you use it to get in, and getting in reveals new things to learn. So you drop back to discovery from a better vantage point. The map you draw from outside is nothing like the one you draw from a foothold inside.

Discovery is reconnaissance, and it comes in flavors. Passive recon watches without touching: OSINT from public sources, footprinting the organization's exposed surface. It leaves no trace. Active recon actually probes, which is louder but richer. It even goes physical: war driving to find wireless networks from a car, or war flying to do the same from a drone. The goal throughout is to build the attack surface before you attack it.

flowchart LR D["Discovery<br/>passive/active recon · OSINT · footprinting · war driving/flying"] <--> A["Attack<br/>gain access → escalate → lateral movement"] A --> CU["Post-test cleanup<br/>remove backdoors · restore state"]
How a Pen Test Actually Runs: Discovery, Attack, and Leaving No Trace

The attack phase is the part people picture, and it has a shape: gain access through some weakness, escalate privileges from whatever you landed as to something powerful, then move laterally to reach what you actually came for. Two techniques carry a lot of the weight. Pivoting is using a system you've already popped, often a soft, low-value box, as a foothold to reach the hardened targets you couldn't touch from outside. The weak machine becomes your inside vantage point. Persistence is installing a way back in that doesn't depend on the original exploit: a backdoor. So when the hole you came through gets patched, you're still there.

flowchart LR EXT["Attacker (outside)"] -->|exploit| WEAK["Weak box<br/>(foothold)"] WEAK -->|pivot from inside| HARD["Hardened target"] WEAK -. "persistence: backdoor" .-> WEAK
How a Pen Test Actually Runs: Discovery, Attack, and Leaving No Trace

The part amateurs skip is the ending. A professional pentest cleans up after itself: remove the backdoors, delete the tools and artifacts, and restore every modified system to its pre-test state. You were simulating an attacker, not becoming a liability. Leaving persistence mechanisms or altered configs behind turns your security assessment into the very thing it was supposed to find. Test, document, and put everything back the way you found it.