Put yourself in the shoes of an attacker for a moment. Do you believe you would be following a methodology like the OSSTMM or the Pentesting Execution Standard? Would you use a more rudimentary identify, scan, enumerate, attack methodology? Would you use no methodology at all other than blindly launching attacks in hopes of having something stick? Explain your decision and consider what sort of attacker might use which approach if there is a difference.