the correct path in penetration testing :