Any security attack state model

["ricci" <ricci () cs ust hk>]

Hello All,

I have been working on IT security attack methodology. Is there any security
attack methodology and category information that has been adopted by IT
market?

Besides, as I thought through security attack methodology, there should be
some step by step attack states. That is, after port scanning, you will be
able to attack web, etc. Is there any methodology or good reference
document?

Please advise.

Thx.

Ricci