Penetration testing -- what do you guys do

Hello everyone.

I just want to get a basic idea of what to do in a penetration test.

Suppose, if i get a project, how will i report the vulns to the owner.

Some helpful links would be enough.

These are the things i'm thinking of doing in it :

1. Web app security check for some common vuln. like SQLi, XSS, LFI, RFI etc.

2. NMAP scan to check for open ports and the services running on it.

3. Scanning with some vuln. scanners like Acunetix, w3af, Nessus and Nikto.

4. Finding exploits for the services running on it.

Is there something else i need to do?
And could anyone help with the report thing?

This is not the place to learn how to do penetration testing.
Having said that, there are plenty of tutorial on the net that will aid you. You should definately start looking for some sort of methodologies to follow. There is no 1 perfect one, so it is up to the person doing the testing take what they need from the various ones available and to even create their own if needed.
http://en.wikipedia.org/wiki/Penetra...#Methodologies
http://www.pentest-standard.org/index.php/Main_Page