After discovering the weaknesses and vulnerabilities, access is made directly to the system, that is, it is the part where attacks are effectively carried out. Generally, the main tests consist of dropping backdoors to test the ease of entry and maintenance of the attack.
In addition, other attacks such as SQL injection are used. Thus, having managed to enter, the tests are now to identify what is possible to do with that attack carried out, such as changing a password or stealing a database. It is also at this moment that social engineering is carried out, using a company employee who is not aware of the process carried out, so as not to interfere with their participation