Typorithm · medium

Methodologies (PTES, NIST)

pentest-methodologiespentestptesmethodologykill-chain

Saved on this device

Full lesson · 8 learning steps Open any exercise for focused practice

Step 1 of 8 · intro card

Learn Methodologies (PTES, NIST)

Engagement

Standards like PTES, OSSTMM, and NIST 800-115 give a repeatable structure to an engagement. Work flows pre-engagement → intelligence → threat modeling → exploitation → post-exploitation → reporting. The cyber kill chain and MITRE ATT&CK provide a shared vocabulary for describing adversary behavior.

A methodology turns testing into a repeatable, defensible process. PTES (Penetration Testing Execution Standard), OSSTMM, and NIST SP 800-115 each lay out phases so two testers on the same scope produce comparable, thorough results rather than ad-hoc poking.

The phases run in order: pre-engagement (scope and RoE), intelligence gathering (recon and OSINT), threat modeling (prioritize targets), exploitation (validate vulnerabilities), post-exploitation (assess real impact), and reporting (findings and fixes). Each phase feeds the next.

Frameworks like Lockheed Martin's cyber kill chain and MITRE ATT&CK map how real adversaries operate, from reconnaissance to actions on objectives. Using their vocabulary makes your findings legible to the blue team, who use the same frameworks to build detections.

PTES, OSSTMM, and NIST 800-115 define repeatable phases.

Flow: pre-engagement → intelligence → threat modeling → exploitation → post-exploitation → reporting.

The kill chain and MITRE ATT&CK describe adversary behavior for both sides.

phases:
  pre_engagement: scope-and-roe
  intelligence: recon-osint
  threat_modeling: prioritize-targets
  exploitation: validate-vulns
  post_exploitation: assess-impact
  reporting: findings-and-fixes

Read the implementation

Connect each part of the code to the concept before you type.

1. Pre-engagement

Everything starts with agreeing scope and rules of engagement before any active testing.

pre_engagement: scope-and-roe

2. Intelligence gathering

Reconnaissance and open-source intelligence map the in-scope attack surface.

intelligence: recon-osint

3. Threat modeling

Threat modeling ranks targets by likely value and exposure so effort goes where it matters.

threat_modeling: prioritize-targets

4. Exploitation

Exploitation validates whether a suspected weakness is genuinely exploitable, not just theoretical.

exploitation: validate-vulns

5. Reporting

The report is the deliverable: clear findings, risk ratings, and remediation guidance defenders can act on.

reporting: findings-and-fixes

A complete learning loop

Understand

Read the concept map and follow the code breakdown.

Reconstruct

Type the implementation, repair mistakes and work through every recall exercise.

Verify

Use the final check without hints; revisit weak concepts in short practice sessions.