The five phases of ethical hacking and how defenders respond
In short: Hacking attempts are often described in five phases: reconnaissance, scanning, gaining access, maintaining access and covering tracks. Ethical hackers use the same model with permission and replace "covering tracks" with reporting. Defenders can use it to place controls and detections at every stage.
Why a phase model helps
An attack is rarely one action. It is a sequence: learn about the target, find a way in, get in, stay in, and avoid being caught. Splitting this into phases helps testers plan their work and helps defenders see that there are several chances to stop an attacker, not just one. The five-phase model is taught in many ethical hacking courses and certifications. More detailed models, such as the Cyber Kill Chain and MITRE ATT&CK, describe the same journey in finer steps.
The phases in plain words
- Reconnaissance. Collecting information about the target: domains, staff names, technologies in use and exposed services. Much of it is public. See reconnaissance and OSINT.
- Scanning and enumeration. Actively probing to find live hosts, open ports, service versions and user names. See scanning and enumeration.
- Gaining access. Using a weakness to get in, such as a stolen password, an unpatched service, a misconfiguration or a phishing email.
- Maintaining access. Making sure access survives a reboot or password change, for example by creating accounts, scheduled tasks or remote access tools. Attackers also try to raise their privileges and move to other systems.
- Covering tracks. Deleting or changing logs and files to hide what happened.
Moving inside the network
Between gaining and maintaining access, many models add steps for privilege escalation (turning a normal account into an administrator) and lateral movement (hopping from the first machine to others). These steps are where small organisations often lose the most, because a flat network and shared admin passwords let one infected laptop reach every server. Separate admin accounts, unique local administrator passwords and network segmentation all slow this part down.
How ethical hacking differs
An ethical hacker follows the same early phases but under agreed scope and rules. Gaining access is done carefully to prove a risk, not to cause damage. Maintaining access is usually limited to showing it would be possible, and anything created is removed afterwards. Instead of covering tracks, the tester keeps detailed notes and writes a report, often including whether the defenders noticed. Many testers call the last phase reporting or clean-up.
Defending each phase
Defenders do not need to win at every phase; they need to win at one. A small public footprint makes reconnaissance harder. Fewer exposed services leave little to scan. Patching and MFA block most ways in. Endpoint detection and alerts on new admin accounts catch persistence. Sending logs to a central system the attacker cannot reach means covering tracks fails, and a sudden gap in logging becomes an alert in its own right.
Real-world example: an engineering firm's test
A fictional engineering firm hires testers for an authorised external test. In reconnaissance they find staff email formats on the company website. Scanning shows a remote desktop gateway exposed to the internet. A password spray with a single common password per account, allowed under the rules of engagement, succeeds on one test account that lacked MFA. The testers stop at proving access and report. The firm adds MFA to every account, puts the gateway behind its VPN and sets an alert for spraying patterns. The report shows that two different phases could each have stopped the attack.
Practice
In which phase would an attacker create a scheduled task that runs their tool at every start-up?
What replaces "covering tracks" in an ethical engagement?
Why do central, protected logs help against the final phase?
Key takeaways
- The five phases are reconnaissance, scanning, gaining access, maintaining access and covering tracks.
- Ethical hackers follow the same path within scope and finish with reporting and clean-up.
- Each phase has its own defences and detections.
- Stopping any one phase can stop the whole attack.
- Detailed models such as ATT&CK break the same journey into finer steps.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.