Penetration Testing Methodology

Authorised testing only. BastionWolf performs testing solely against systems the client owns or is entitled to authorise, under written authorisation, and strictly within the scope agreed in advance.

Denial-of-service, destructive actions and testing of third-party infrastructure are excluded unless separately and explicitly authorised in writing by every party involved.

The engagement

Eleven phases, every time

The depth of each phase varies with the scope. An API test and an internal network test look very different in practice, but the structure does not change, and nothing is skipped quietly.

Scoping

Targets, environments, credentials, test windows, third-party notifications and success criteria are agreed and documented. Written authorisation is obtained before any testing activity.
Reconnaissance

Passive and active information gathering across the agreed scope: hosts, services, domains, exposed endpoints, technologies and publicly available information relevant to the target.
Attack surface mapping

Enumerating application routes, API operations, authentication flows, roles, trust boundaries and network services to build a complete picture of what can be reached and by whom.
Vulnerability discovery

Automated scanning combined with manual review of authentication, authorisation, input handling, session management, business logic, configuration and known-vulnerable components.
Manual exploitation

Candidate issues are exploited by hand to confirm they are real, measure their true impact and eliminate false positives. Destructive techniques are excluded unless explicitly authorised.
Risk validation

Each confirmed issue is assessed for exploitability, business impact and exposure, then rated using CVSS alongside a plain-language explanation of what it means in your environment.
Privilege escalation & lateral movement

Where in scope, we establish how far an attacker could get from an initial foothold through horizontal and vertical privilege escalation, and movement between systems or tenants.
Evidence collection

Requests, responses, screenshots and reproduction steps are captured for every finding so your team can reproduce and verify it without guesswork.
Reporting

An executive summary for decision-makers, full technical detail for engineers, an ordered remediation list and a clear statement of what was and was not tested.
Remediation guidance

Practical, stack-specific fixes and architectural recommendations, plus a debrief session with your engineering team to work through the findings.
Retesting

Once fixes are deployed we retest the affected findings and issue a retest summary confirming which issues are closed.

Standards & references

Methodologies we work to

Recognised methodologies give coverage a defensible structure and make results comparable between engagements and between suppliers. They are a framework for the work, not a substitute for it.

We reference the frameworks below in scoping documents and reports so your stakeholders, customers and auditors can see exactly what coverage a test was built around.

OWASP Web Security Testing Guide: Provides the structure for web application test coverage, from configuration and identity management through to business logic.
OWASP Top 10: Used as a baseline risk reference when communicating web application findings to non-specialist stakeholders.
OWASP API Security Top 10: Guides API testing coverage, particularly object-level and function-level authorisation and resource consumption issues.
PTES: The Penetration Testing Execution Standard informs engagement structure: pre-engagement, intelligence gathering, threat modelling, exploitation, post-exploitation and reporting.
NIST SP 800-115: Referenced for technical assessment planning, execution and post-assessment handling of results.
CVSS: Used for consistent, comparable severity scoring, always alongside a contextual impact statement for your environment.

What the report contains

Executive summary written for non-technical stakeholders
Scope statement covering what was and was not tested
Each finding with reproduction steps, evidence and affected components
CVSS v3.1 base score plus a contextual risk rating for your environment
Remediation guidance specific to your technology stack
A prioritised action list ordered by risk, not by finding count
Retest summary confirming which findings are closed

Reporting

Findings your developers can act on the same week

A report full of scanner output helps nobody. Ours is written so an engineer can reproduce a finding in minutes and a director can understand the business exposure in a paragraph.

Critical findings are reported as soon as they are confirmed. You will hear from us during the test, not two weeks later. Once the report is delivered we run a debrief with your engineering team to work through the findings and answer questions before remediation starts.

Testing services

Scopes we test

Choose the environment you need assessed

Offensive Security

Scope a penetration test

Send us the targets and constraints. We will come back with a scope, a timeline and a fixed price.

Request a Security Assessment Explore Our Services

Penetration testing methodology

Eleven phases, every time

Scoping

Reconnaissance

Attack surface mapping

Vulnerability discovery

Manual exploitation

Risk validation

Privilege escalation & lateral movement

Evidence collection

Reporting

Remediation guidance

Retesting

Methodologies we work to

What the report contains

Findings your developers can act on the same week

Choose the environment you need assessed

Web Application Penetration Testing

API Penetration Testing

Network Penetration Testing

Cloud Penetration Testing

Vulnerability Assessment

Scope a penetration test