In this chapter, we have learned how to perform a full penetration test case on a real target machine. We knew nothing other than the domain name of the target system in the beginning. We have built a full profile of the target server, getting to know it better. We have performed the full auditing process, and finally achieved our goal by exploiting the vulnerability using Metasploit. All data shown in this document is real; the IP addresses and any reference to the server have been blanked or manipulated for security reasons.

This is just one of the methodologies of real penetration testing, step-by-step from the beginning to the end of the process. Several details were skipped, which was done purposely because a single chapter won't suffice to cover all the potential options we have. Also, we wanted to leave something for curious readers and the new generation of hackers to figure out.

In the final chapter, we will go through documentation and reporting.