For a blind test you'll want to start with a network scanner and port scanner such as Nmap. You have to do this to see what's out there, what types of systems you're attempting to penetrate, and what services are running that it might be possible to exploit. Once you know what's there, you can select the appropriate tools and tests to proceed with. If you're using free tools, you may follow up your Nmap scan with Nessus, for example, to see what vulnerabilities are present and how serious they may be. Nessus produces excellent reports and can run refined tests for particular types of targets.
If you're using a commercial testing product, here is where you will want to fine tune your tests and their depth based on your initial scans. Once you've identified the vulnerabilities present, you'll want to run specific exploit tests or custom attacks that prove and verify the vulnerability is real and not a false positive, or not exploitable. Individual testing programs specific to a particular vulnerability are often available, or custom code can be written or extended using platforms like Metasploit.
Compile and format your results based on your findings. I often take screenshots or other proof of penetrations & crashes for supporting documentation.
