Published · By the Aesparrow Security Research Team
Short answer
A professional VAPT methodology follows six phases: scoping and rules of engagement, reconnaissance, vulnerability discovery, exploitation, post-exploitation, and reporting with re-testing. Recognised standards that define these phases include PTES, NIST SP 800-115, the OWASP Web Security Testing Guide and OSSTMM, with findings scored using CVSS and mapped to MITRE ATT&CK.
Which penetration testing standards and frameworks are used?
- PTES: Penetration Testing Execution Standard — end-to-end engagement phases.
- NIST SP 800-115: technical guide to information security testing and assessment.
- OWASP WSTG & ASVS: web application testing guide and verification standard.
- OWASP MASVS / MASTG: mobile application security standard and testing guide.
- OSSTMM: open-source security testing methodology manual.
- MITRE ATT&CK: adversary tactics and techniques for red-team style testing.
- CVSS, CWE and CVE: scoring, weakness classification and vulnerability identifiers.
What are the phases of penetration testing?
- 1Pre-engagement and scopingDefine targets, objectives, test type, schedule, contacts and legal authorisation.
- 2ReconnaissanceCollect information passively and actively to map hosts, applications, users and technologies.
- 3Threat modelling and vulnerability discoveryIdentify likely attack paths and scan for candidate vulnerabilities, validating them manually.
- 4ExploitationSafely exploit confirmed vulnerabilities to demonstrate access, data exposure or control.
- 5Post-exploitationAssess privilege escalation, lateral movement and the value of compromised assets.
- 6ReportingDocument findings with evidence, CVSS severity, business impact and remediation steps.
- 7Remediation verificationRe-test fixed issues and issue an updated report or attestation.
FAQ
Frequently Asked Questions
Clear answers about what we do — and what we don’t. If you have any other questions, feel free to reach out to our team.
What is the difference between manual and automated penetration testing?
Automated testing uses scanners to find known issues quickly; manual testing uses human expertise to find logic flaws, chain vulnerabilities and confirm impact. Effective VAPT combines both, led by manual work.
What is black box vs white box penetration testing?
Black box testing gives testers no internal knowledge, simulating an outside attacker. White box testing provides source code and architecture for maximum depth. Grey box sits in between, with user credentials and some documentation.