Which of the following penetration testing phases involves gathering data from whois, DNS, and network scanning, which helps in mapping a target network and provides valuable information regarding the

The post-attack phase occurs after exploitation has concluded and covers activities such as evidence collection, system restoration, and report writing.

The attack phase is when the tester actively exploits the vulnerabilities discovered during reconnaissance to gain unauthorized access to target systems.

In the EC-Council penetration testing methodology, the pre-attack phase is dedicated entirely to information gathering and reconnaissance. Testers use techniques such as whois lookups, DNS enumeration, and network scanning to map IP ranges, identify operating systems, enumerate running services, and profile the target environment. All of this intelligence is collected prior to any active exploitation so the tester can plan an informed attack strategy.

'On-attack phase' is not a recognized stage in standard penetration testing methodologies such as those defined by EC-Council or PTES.