Before a single packet is sent, the engagement must be legally authorized and operationally defined. Scope creep, unauthorized access, and ambiguous rules of engagement are the leading causes of failed engagements — and legal exposure.

Passive reconnaissance gathers intelligence about the target without directly touching their infrastructure. The goal is to build a complete profile — employees, technologies, exposed services, partner relationships — before any active scanning begins.

Active scanning directly interacts with target systems to enumerate open ports, running services, software versions, and potential vulnerabilities. This phase generates network traffic and may trigger IDS/IPS alerts — stealth tuning matters.

The goal is to obtain the first foothold — a shell, session, or credential that grants access to the internal environment. Initial access vectors range from technical exploitation to social engineering to abusing legitimate services.

With a foothold established, the focus shifts to understanding the local host, harvesting credentials, and identifying what internal access is available. Don't rush to move laterally — thorough post-ex on the initial host often yields the fastest path to objectives.

Lateral movement is the process of expanding access from the initial foothold to other systems in the environment. In Active Directory environments this often means moving toward Domain Controller access — the crown jewel of an AD compromise.

Reaching the engagement's defined objectives — whether that's domain admin, access to sensitive data, proof of exfiltration capability, or demonstrating a specific impact scenario. Document everything; this becomes the core of the technical report.

The report is the primary deliverable — it's what the client pays for. A technically brilliant engagement with a poor report has diminished value. Clean up all artifacts and persistence mechanisms before submitting, and walk the client through findings in a debrief call.