Cybersecurity courses often describe hacking as five phases: reconnaissance, scanning, gaining access, maintaining access, and covering tracks. The model is a useful introduction, but real incidents do not always follow it in a perfect straight line. An attacker may repeat earlier steps, skip a phase, or change direction when a system behaves differently than expected.
The same framework is also useful to defenders and ethical hackers. The difference is permission and purpose. An ethical hacker works within written authorization, follows an agreed scope, avoids unnecessary harm, and reports findings so they can be fixed. Testing a system without permission is not made acceptable by good intentions.
1. Reconnaissance
Reconnaissance is the information-gathering phase. The goal is to understand the target before interacting with it deeply. Public websites, domain records, job listings, documentation, social media, and exposed technical details can reveal how an organization is structured and which technologies it may use.
Reconnaissance may be passive, using information that is already public, or active, involving direct contact with systems. For defenders, this phase is a reminder that small pieces of public information can become valuable when combined. Reviewing what your organization exposes online can reduce that advantage.
2. Scanning and Enumeration
Scanning turns general information into a more detailed map. A tester identifies reachable systems, available services, software versions, accounts, and possible weaknesses. Enumeration goes further by organizing what those systems reveal about users, resources, and configurations.
A scan result is not proof that a system can be compromised. It is a clue that needs careful verification. Ethical testing controls the speed and scope of scanning because aggressive activity can disrupt fragile services. Defenders can limit exposure with firewalls, secure configuration, timely updates, and monitoring for unusual discovery activity.
3. Gaining Access
In this phase, an attacker attempts to use a weakness to enter a system or reach information that should be protected. The weakness might involve outdated software, an unsafe configuration, stolen credentials, excessive permissions, or social engineering.
Authorized testers prove the risk with the least impact necessary. They stop at the agreed boundary, protect any data they encounter, and document evidence rather than causing damage. Strong authentication, least-privilege access, patching, input validation, and user awareness all make this phase more difficult.
4. Maintaining Access
After gaining entry, a malicious attacker may try to keep that access even if the original weakness is fixed. This is known as persistence. They may also attempt to move between systems or increase their privileges.
Ethical hackers generally simulate or demonstrate persistence only when the rules of engagement allow it. Defenders should watch for unexpected accounts, altered startup settings, unfamiliar scheduled tasks, unusual authentication patterns, and changes to security controls. Network separation and limited privileges help contain an intrusion.
5. Covering Tracks
A malicious attacker may try to hide evidence by removing traces, disguising activity, or blending into normal traffic. This can delay detection and make an investigation harder. The phase explains why keeping reliable records outside a single device matters.
An ethical hacker should not erase evidence. Instead, the engagement ends with cleanup and reporting: remove approved test artifacts, return systems to their original state, preserve an activity log, and explain what was found. Centralized logs, protected backups, time synchronization, and alerts help defenders retain evidence when a real attacker tries to hide.
What Happens After the Five Phases?
For an ethical assessment, the most valuable work comes next. Findings are confirmed, ranked by risk, and written in language the system owner can act on. A useful report explains what is affected, why it matters, what evidence supports the finding, and how to fix it. After remediation, a retest checks that the weakness is actually closed.
The phases describe a process, not permission. Authorization, scope, careful evidence handling, and responsible reporting are what turn security testing into ethical hacking.
Understanding the phases helps defenders interrupt attacks earlier. Reduce exposed information, monitor discovery, harden access, detect persistence, protect logs, and practice incident response. Security becomes stronger when every phase has a corresponding defense.