I'd like to ask you what should be satisfactory result of pen-testing job?

My main concern is that pen-testing is hard and it won't always result in gaining remote shells or roots. However, it is much easier to list potential vulnerabilities.

For example, if there's PHP version 4 from 2007 I can list it as potential vector but I may be unable to exploit it. Is successful exploitation a requirement for pen-testing job? Would vulnerability scan be good result of the job as well if there's some successful exploitation included (but accounts for less than 1% of all possible issues).

As someone who contracts pen-testers more than I act as a pen-tester, what I'm looking for is that you did more than run Nessus/ZAP/Burp - I can do that myself (though I expect that you do that as well).  I expect you watch the dataflows in the app/website and look for those loose threads that indicate there is a logic error that might be exploitable.  I expect that you are able to tell me what you can glean from the outside, that you can tell me things that cause concern that couldn't be found with a scan.

I'm looking for indications that you looked at, for instance, password reset screens and considered whether the flow is exploitable.  I want to see that you've considered whether privileged information is available to unprivileged users (ie, is the app just using css to hide it or something daft like that).

Ideally, I've done the easy stuff before I contract you - I've done the scan, I've done the patches and I've picked all the low-hanging fruit.  I hire a pen-tester for the hard stuff.

Really, if you don't manage an exploit, I want to see that you've worn your fingernails down scratching at the outside looking for a crack.
