Infecting a system with malware and using phishing to gain credentials to a system or web application are examples of which phase of the ethical hacking methodology?

Reconnaissance (or information gathering) is the initial phase where an attacker passively or actively collects information about the target *before* attempting to gain access.

Maintaining access is a post-exploitation phase where an attacker tries to retain control over a compromised system, often by installing backdoors or rootkits, after access has already been gained.

Scanning is the phase where an attacker uses tools to identify open ports, services, and potential vulnerabilities, typically *after* reconnaissance but *before* attempting to gain access.

Infecting a system with malware (like a Trojan) or successfully using phishing to obtain credentials directly leads to establishing unauthorized entry or control over a target. These actions are primary mechanisms for 'gaining access' to a system or network, allowing an ethical hacker to proceed with further exploitation or post-exploitation activities.