Follow process and reasoning Provide hints? Information Gathering Vulnerability Assessment Exploitation Post-exploitation