Inside a manual penetration test: how it actually works, phase by phase

Most pentest methodology articles read like a slide from 2009: reconnaissance, scanning, exploitation, reporting. True, and useless, because they never explain what a senior tester actually does all day. This is the version we give prospects on scope calls.

Phase 0: the scope call nobody bills for

Before any testing, one conversation maps what you have, what you fear, and what is actually worth attacking. Half of this call is usually us talking you out of testing things that do not need it. The output is a written scope and rules of engagement, which protects both sides.

Recon: building the map

We enumerate your attack surface the way an attacker who found you accidentally would: subdomains, forgotten staging environments, old JavaScript bundles with endpoints that no longer exist in documentation, employee names for later phishing paths. The deliverable nobody mentions is the map itself; clients routinely discover assets they forgot they owned.

The automated pass: 20 percent of effort, 80 percent of easy wins

Yes, manual-first firms run scanners. We run them early to clear the noise: known CVEs, missing headers, default credentials. Then we do the thing scanners cannot: we read the application like a user with intent.

Manual testing: where the day goes

This is the long middle, and it looks like this: clicking through your business flows as three different user roles and comparing what each can see. Editing requests to ask whether invoice 1042 belongs to this account. Checking whether the admin panel you removed from the nav still exists at the URL. Tracing one low finding into another until the chain reaches something that matters.

The findings that end careers are never "SQL injection." They are "any user can read any record," found by thinking, not by tooling.

Exploit chaining and impact proof

A finding is not a finding until it is proven. We chain weaknesses into a working path and demonstrate impact with evidence your engineers can reproduce, then stop. No destructive actions, no data exfiltration beyond proof, everything inside the agreed rules.

Reporting: two documents, one decision

• Executive brief: what matters, why, ranked by what we would exploit first. Ten minutes to read.
• Technical report: reproduction steps, working PoCs, CVSS scoring, stack-specific fixes.

The retest: the phase that makes it real

Free, within 30 days of your fixes. An engagement closes when findings are verified closed, not when the invoice clears. That policy costs us margin and earns us renewals.

Curious how this maps to a quote? See what a pentest costs in India, or go straight to our method page.