I have been interested in security lately, I have been reading mainly cookbooks on Metasploit framework, how social engineering has been employed exhaustively, I have started reading some IA-32 concepts, but then I get confused at some point. If I take into account an attack with no user interaction - no possibility of client-side attack - , no framework like Metasploit available, no nmap, no nessus. What and how does a pentest happen? What's in the core?
Hypothetically speaking, a friend of mine runs an amateurish webserver he coded, full of flaws and vulnerability. This server is running on port 80. I went his home, I got a copy of the software with no permission and write out his network infos. At home I scrutinized the code and I found a stack overflow vulnerability.
But what's next? Here I can barely concatenate. My exploit, as a client(browser), needs to connect to his webserver on port 80 in order to exploit the vulnerability and deploy the payload(a reverse one)? The latter is going to need to act as a server to connect back to my another client that is listening, waiting for a shell? I am quite confused about "naked pentest", I feel there are misunderstandings I unfortunately made that I would like some explanations to fill in the gaps in order for me to move on. Besides that, english is not my first language. Thanks in advance.