A pentest is not a chaotic string of attempts: it is a structured process that advances through chained phases, each with a clear purpose and an output that feeds the next. Understanding this cycle at a high level is essential before diving into specific techniques, because it gives you a mental map of where you are at each moment and what you are after. In this lesson we will walk through the phases of the cycle—reconnaissance, scanning and enumeration, exploitation, post-exploitation, and reporting and remediation—we will see how they chain together via a diagram, and how each phase maps to a module of the course.

Important: here we work on the big picture. We will not develop the techniques of each phase (that lives in modules 2 to 6); our goal is for you to understand the purpose of each stage and how they connect, and to place TechNova at the start of the cycle.

1. Why pentesting follows a cycle of phases
2. The complete flow (diagram)
3. Purpose of each phase
4. Mapping phases to course modules
5. TechNova at the start of the cycle

Working in phases brings three fundamental advantages:

• Rigor and repeatability: always following the same process avoids skipping steps and makes the work auditable and comparable across projects.
• Efficiency: each phase produces information that the next one leverages. There is no point in trying to exploit a service you don't yet know exists.
• Coverage: an orderly process reduces the risk of leaving areas of the scope unassessed.

It is important to understand that, although the phases are presented in order, in practice the process is iterative: upon reaching post-exploitation it is common to discover new systems and go back to reconnaissance and scanning of that new network. The cycle repeats until the scope is covered.

The following mermaid diagram shows the flow of the phases and their iterative nature. Notice the return arrow from post-exploitation: it represents that new access opens new targets that restart the cycle.

Before the first phase there is always an indispensable prior step: preparation and authorization (contract, scope, and Rules of Engagement). It does not appear as a "technical" phase because nothing is attacked, but without it nothing else is legitimate. We cover it thoroughly in lesson 01-04.

Let's see what each stage is after, without going into the techniques (which belong to the later modules).

Objective: gather all the information possible about the target to understand its attack surface. A distinction is made between passive reconnaissance (without touching the target, using public sources) and active reconnaissance (interacting lightly with it). It is the "know the terrain" phase before taking action.

Objective: based on what was discovered, technically identify which ports are open, which services and versions run on them, and enumerate resources (users, shares, directories). Here you move from "what exists" to "what is exposed and how." The result is a prioritized list of possible entry points.

Objective: attempt to take advantage of the identified weaknesses to gain access or demonstrate the impact, always within scope and minimizing damage. It is the moment when you verify that a vulnerability is real and exploitable, not just theoretical. It is the phase most associated with pentesting, though it is only one part of the cycle.

Objective: once inside, assess how far you can get: escalate privileges, move to other systems (lateral movement), and measure the real impact (can you reach customer data? the network controller?). Here you also decide, according to the RoE, whether to maintain access for the tests. As the diagram shows, this phase often restarts the cycle on the newly discovered systems.

Objective: turn everything found into value for the client. Findings are documented, classified by risk, remediation recommendations are proposed, and the results are presented. It is, without exaggeration, the most important phase: a brilliant finding that is not communicated well is a lost finding. The deliverable is the real product of the pentest.

The following table summarizes the input and output of each phase, so you can see how they chain together:

A key idea of this course is that each phase is developed in its own module. This lesson is the index; the following modules are the detail. Keep this table as a reference:

Module 7 (Tools) is cross-cutting: it covers the tooling (Kali, Metasploit, Burp Suite, ZAP) used across several phases. That is why it does not appear as a phase of the cycle, but as support for all of them.

Let's place our case study. In the TechNova S.L. audit we have already defined the type of test (external + web + gray box, with an internal expansion) and we are about to close the contract and the RoE. In other words, we are before the first technical phase: at the starting line of the cycle.

As soon as the authorization is signed, the first real action on TechNova will be the reconnaissance of tienda.technova.lab and the range 10.10.10.0/24. But, we insist, not yet: first we must lock down the legal and ethical framework. That is exactly the content of the next lesson.

• Skipping reconnaissance. Rushing into exploitation without knowing the terrain wastes time and increases the risk of touching something out of scope.
• Believing that exploitation is "the pentest." It is only one phase; the report usually brings the client more value than the access itself.
• Forgetting the iterative nature. Post-exploitation almost always opens new targets that restart the cycle; don't treat it as a strictly linear process.
• Neglecting documentation during the phases. Don't wait until the end to document: record evidence in every phase, because the report draws on it.
• Tip: use this cycle as a mental checklist. Asking yourself "which phase am I in and what am I looking for here?" keeps the work focused and orderly.

Exercise 1. Put these phases in order and explain in one sentence the purpose of each: exploitation, reporting and remediation, reconnaissance, post-exploitation, scanning and enumeration.

Exercise 2. Explain in your own words why the pentesting cycle is iterative and not purely linear. Give an example related to TechNova.

Exercise 3. Match each phase with the course module where it is developed in detail.

Solution 1. Correct order: 1) Reconnaissance — gather information and understand the attack surface. 2) Scanning and enumeration — identify open ports, services, and exposed resources. 3) Exploitation — verify and take advantage of weaknesses to gain access, within scope. 4) Post-exploitation — assess how far you can get, escalate, and measure the real impact. 5) Reporting and remediation — document, classify by risk, and recommend fixes.

Solution 2. It is iterative because each new access may reveal systems or networks that were not visible before, and those new targets require going back to reconnaissance and scanning. Example with TechNova: upon compromising the web store (tienda.technova.lab) we discover that it is connected to the internal network 10.10.10.0/24; that discovery restarts the cycle, this time on the internal Linux server and the network controller.

Solution 3. Reconnaissance → Module 2; Scanning and enumeration → Module 3; Exploitation → Module 4; Post-exploitation → Module 5; Reporting and remediation → Module 6. (Module 7, Tools, is cross-cutting to all phases.)

We have walked at a high level through the pentesting cycle: reconnaissance → scanning and enumeration → exploitation → post-exploitation → reporting and remediation, a structured and iterative process in which each phase feeds the next and in which the final report is the true product. We have also seen that each phase maps to a module of the course, so this lesson works as a general map of the journey. TechNova is at the starting line, waiting for the authorization to be finalized.

And that authorization is precisely what we will address next. In the next lesson, 01-04 Ethics and Legality in Pentesting, we will see the contract, the scope, the Rules of Engagement, and the legal framework that make this whole activity legitimate. Without that framework, the cycle we have just described cannot even begin.