A penetration test has five phases:

Reconnaissance: testers gather as much information about a target system as they can, such as information about the network topology, operating systems, applications, user accounts, and anything else that they can use to exploit the system.

Scanning: during this phase, testers use various tools to check network traffic and identify open ports and other potential entry points.

Vulnerability Assessment: this is when testers determine the risk of the vulnerabilities discovered during the first two phases.

Exploitation: now, the tester will attempt to exploit the target system by simulating a real-world cyberattack.

Reporting: The final phase is when the penetration tester prepares a document reporting the findings during each pentest stage.