To add to ewanm89's answer, a general approach to penetration testing is done by dividing the test up in different phases:
- Discovery / Information Gathering
During the planning phase, you typically set the scope of attack (What systems and what parts of it to test)
Discovery / Information Gathering
Host discovery, service discovery, network topology mapping, finding http/html form fields that can tested further. What information you need to gather is depending on what kind of security test you are going to perform.
Probing for vulnerabilities on the services you dicovered in the previous phase. As you most likely will find new and more relevant information during the attack phase, you will move between the discovery and attack phase. I.e. backend sql server behind the web server.
In this section you report your findings.
The final report typically have the following sections:
- Executive Summary
- Detailed Findings
- Risk levels of vulnerabilities found
- Business Impact
The following link describe this approach with details: