The Hacker Methodology: From Recon to Reporting
Phase 2 handed you a toolbox: Linux, networking, and a full week on information gathering. Before you pick up the next tool, take two minutes to see the whole engagement, the six stages every real penetration test moves through, from the first Google search to the final report.
The six stages
- Reconnaissance , what exists? Domains, subdomains, IP ranges, technologies, people.
- Enumeration / Scanning , what's reachable, and what exactly is running on it?
- Gaining Access , turning a known weakness into an actual foothold on the system.
- Privilege Escalation , turning that limited foothold into full control.
- Covering Tracks , cleaning up so the test (or the intrusion) isn't trivially spotted afterward.
- Reporting , writing up what you found so someone can actually fix it.
Every one of these depends on the one before it. You can't exploit a weakness you never found. You can't escalate privileges you never had a foothold to escalate from. You can't write a report about work you never did. The order isn't a suggestion, it's the whole structure of the job.
Where you already are
Phase 2, Week 8 was entirely stages 1 and 2. Look back at what you covered:
| Stage | Covered in |
|---|---|
| Reconnaissance | Subdomain Enumeration, the recon half of the Big Picture lesson |
| Enumeration / Scanning | Port Scanning with nmap, Service Enumeration, Wordlists, Directory & Content Discovery, Deeper Web Recon |
By the end of that week you could take a target from "a company name" to "a detailed list of live hosts, open ports, running services, and hidden pages." That's stages 1 and 2, done properly.
Right after this lesson, Week 12 gives you a first taste of stage 4, Privilege Escalation: SUID binaries, sudo misconfigurations, and GTFOBins. That's real, useful material, but it's an introduction, not the full picture.
What's still ahead
Two stages haven't been taught at all yet, and one needs to go deeper:
- Gaining Access , actually turning a discovered weakness (an outdated service, a default password, a known vulnerability) into a working foothold on the box. That's the very next week, Gaining Access: Web Exploitation, where you attack the web apps recon surfaced with SQL injection, XSS, and broken access control.
- Privilege Escalation, in depth , Week 12 is only the introduction. There's a lot more ground here: kernel exploits, misconfigured cron jobs, credential hunting, Windows-specific paths, and more, all coming in upcoming lessons.
- Covering Tracks and Reporting , the two stages that turn "I broke into a box" into "I did a professional, accountable security test." Also coming in upcoming lessons of this phase.
Why this matters
It's tempting to treat "gaining access" as the fun part and everything else as homework. In practice it's the opposite: recon and enumeration are where most of the real work happens, and reporting is what actually gets the vulnerability fixed. A hacker who can exploit but can't explain what they did or clean up after themselves isn't doing professional work, they're just making noise. Keep the whole six-stage flow in view as you go deeper into each piece.