A typical penetration test includes several stages: Planning and reconnaissance to define the scope and gather intelligence, scanning to understand how the target application responds to various intrusion attempts, gaining access using web application attacks, maintaining access to see if the vulnerability can be used to achieve a persistent presence in the exploited system, and analysis to compile the results, detailing vulnerabilities, and suggesting mitigations.