Before any tool: the contract
In Pakistan, unauthorized access is a PECA §3 offence — there is no "white hat" exception without written authorization. Every engagement starts with:
- Rules of Engagement (RoE): targets (IPs/domains/apps), techniques allowed/forbidden (DoS? social engineering? physical?), time windows, emergency abort contacts, data-handling rules.
- Signed scope document from the asset owner — not just IT.
- Get-out-of-jail card: the signed authorization carried during testing.
The methodology (PTES-flavored)
Recon (passive first: WHOIS history, Shodan/Censys caches, Google dorks, employee LinkedIn OSINT, breach data) → Scanning (nmap service/version discovery; nuclei templates for known CVEs) → Vulnerability analysis (manual verification > scanner output) → Exploitation (controlled, reversible, logged) → Post-exploitation (privilege paths, persistence TESTING only where RoE allows) → Reporting.
The report is the product
Findings: title, severity (CVSS + business context), affected asset, reproduction steps, proof (sanitized), remediation, references. Executives read page 1; engineers read the repro steps. A pentest without a usable report is a hobby.
Free practice (legal): TryHackMe/HackTheBox paths, PortSwigger Web Security Academy (the best free web-app course on earth), PicoCTF, DVWA/Juice-Shop locally. Pakistan's own CTF Square (PKCERT) and our /ctf platform feed this pipeline.