Getting Started: Pentest Workflow

Penetration testing follows a structured workflow. You start by mapping the target, then dig into each service to find weaknesses, exploit them for access, and work your way deeper into the environment. Every step feeds information into the next. This page covers how that workflow maps to HackIndex content, so you know where to find what you need as you work through the OSCP study path.

Pentest Workflow

A penetration test moves through distinct phases. The order is not strictly linear: you often loop back to earlier phases as you discover new targets or credentials. But the general flow is:

• Reconnaissance: passive information gathering without touching the target. OSINT, DNS records, certificate transparency, public metadata.

• Enumeration: active interaction to map services, versions, users, shares, and configuration. This is where you spend most of your time.

• Vulnerability Discovery: confirming that a specific weakness exists. A missing patch, a misconfiguration, a default credential. Proves what is wrong without exploiting it yet.

• Exploitation: using a confirmed weakness to gain access, execute commands, or retrieve protected data.

• Post-Exploitation: situational awareness on a compromised host. Collecting credentials, inspecting trust relationships, identifying pivot targets.

• Privilege Escalation: moving from a low-privilege user to root or SYSTEM on the same host.

• Lateral Movement: using current access to reach other machines in the network. Credential reuse, pass-the-hash, pivoting through tunnels.

• Persistence: maintaining access beyond the current session. SSH keys, scheduled tasks, web shells.

  How HackIndex Is Organized

  Content on HackIndex is organized around two axes: what you are attacking and what phase you are in.

  Services and Platforms

  Each technology has its own section. A service is a network-facing protocol or application: SSH, SMB, LDAP, MSSQL, HTTP, Kerberos, and so on. A platform is an operating system or environment: Active Directory, Windows, Linux. If an attack uses a specific service as its entry point, the content lives under that service. If it targets the platform itself (like AD trust abuse or Linux kernel exploits), it lives under the platform.

  Phases

  Within each service or platform, content is grouped by phase. The phases match the pentest workflow above: Enumeration, Vulnerability Discovery, Exploitation, Privilege Escalation, and so on. This means that when you find an open SMB port and want to know what to enumerate, you go to SMB > Enumeration. When you find a weakness and need the exploit, you go to SMB > Exploitation.

  Articles

  Each article within a phase covers a specific technique, tool, or attack. Articles contain working commands with placeholder variables ($TARGET_IP, $PORT, $USER, $DOMAIN) and realistic sample output where it helps interpretation. The focus is on what to run and how to read the results, not theory.

  Using This Study Path

  The OSCP study path maps PEN-200 modules to HackIndex content. Each module page lists the relevant services, phases, and articles that cover the same skills. The goal is not to replace the official PEN-200 course material, but to give you a free reference with practical commands and techniques for every exam domain.

  Start with the modules you are weakest in. If you can enumerate and exploit a service end-to-end on a practice machine using only the commands from these pages, you have the skill level the exam expects for that topic.