What is post-exploitation in pentesting?

What is post-exploitation in pentesting?

• A. Activities after gaining access to maintain foothold, enumerate further, and prepare for reporting.
• B. Destruction of data after exploitation.
• C. Writing unit tests for app features.
• D. Deploying production code.

Answer: (A)

Post-exploitation is the phase after you’ve gained access to a system during a pentest. The goal is to secure and extend your foothold, continue discovery to understand the target environment, escalate privileges if needed to reach sensitive data, and pivot to additional systems as permitted by the rules of engagement. It also involves gathering evidence, mapping the potential impact, and preparing the findings for the final report, including mitigations and recommendations. Destructive actions or development tasks don’t fit this phase. Destroying data isn’t about testing security controls in a controlled, authorized way, and writing unit tests or deploying production code are software development activities, not security assessment activities.

Post-exploitation is the phase after you’ve gained access to a system during a pentest. The goal is to secure and extend your foothold, continue discovery to understand the target environment, escalate privileges if needed to reach sensitive data, and pivot to additional systems as permitted by the rules of engagement. It also involves gathering evidence, mapping the potential impact, and preparing the findings for the final report, including mitigations and recommendations.

Destructive actions or development tasks don’t fit this phase. Destroying data isn’t about testing security controls in a controlled, authorized way, and writing unit tests or deploying production code are software development activities, not security assessment activities.