Assume you are a consultant working for ACME Security Services, LLC, hired by another company to conduct a security assessment. (You may pick any company you like to conduct your information gathering on) The first step in a pen test is to gather as much information you can on your target company. This consists of how much you can find out about their company concerning their overall network, personnel, technology. This may be infrastructure or desktops, including hardware and software, e-mail addresses, etc.

Information Gathering section, indicating what you were able to find, how you found it, and what you may recommend to the (company) as a way to limit the amount of information that can be found about them. Also, include any names and associated e-mail addresses you find from management that could be used later in a social engineering attack.