Penetration Testing Tutorial: What is PenTest?

What is Penetration Testing?

Penetration Testing or Pen Testing is a type of Security Testing used to uncover vulnerabilities, threats and risks that an attacker could exploit in software applications, networks or web applications. The purpose of penetration testing is to identify and test all possible security vulnerabilities that are present in the software application. Penetration testing is also called Pen Test.

The diagram below shows how an unpatched weakness in an application becomes the doorway an attacker walks through.

Vulnerability is the risk that an attacker can disrupt or gain unauthorized access to the system or any data contained within it. Vulnerabilities are usually introduced by accident during the software development and implementation phase. Common vulnerabilities include design errors, configuration errors and software bugs. Penetration analysis depends upon two mechanisms, namely Vulnerability Assessment and Penetration Testing (VAPT).

The two halves of VAPT are often confused. A vulnerability assessment enumerates known weaknesses at scale and stops there, while a penetration test safely exploits a selection of them to prove real-world impact. Run together, they separate theoretical findings from the ones that genuinely put data at risk.

Why Penetration Testing?

Penetration testing is essential in an enterprise because:

• Financial sectors like banks, investment banking and stock trading exchanges want their data to be secured, and penetration testing is essential to ensure security
• If the software system has already been hacked, the organization wants to determine whether any threats are still present in the system, to avoid future hacks
• Proactive penetration testing is the best safeguard against hackers
• Compliance frameworks expect it. PCI DSS Requirement 11.4, for example, calls for internal and external penetration testing at least annually and after any significant change

Types of Penetration Testing

The type of penetration test selected usually depends on the scope and on whether the organization wants to simulate an attack by an employee or network admin (internal sources) or by external sources. There are three types of penetration testing, and they are

• Black Box Testing
• White Box Penetration testing
• Grey Box Penetration Testing

In black-box penetration testing, a tester has no knowledge about the systems to be tested. The tester is responsible for collecting information about the target network or system.

In white-box penetration testing, the tester is usually provided with complete information about the network or systems to be tested, including the IP address schema, source code and OS details. This can be considered a simulation of an attack by any internal source, such as an employee of the organization.

In grey-box penetration testing, a tester is provided with partial knowledge of the system. It can be considered an attack by an external hacker who had gained illegitimate access to an organization’s network infrastructure documents.

The table below places the three side by side so you can match an engagement type to the threat you actually want to model.

Aspect	Black Box	White Box	Grey Box
Information given to the tester	None	Full: source code, IP schema, OS details	Partial: limited credentials or documents
Attacker being simulated	An outsider with no access	An insider or developer	An outsider who already gained a foothold
Time spent on reconnaissance	High	Low	Moderate
Typical coverage of the code base	Only what is reachable from outside	Deepest, because internals are visible	Focused on the exposed attack path

How to do Penetration Testing

The following activities need to be performed to execute a penetration test. The image below summarises the four phases before each one is described in turn.

Step 1) Planning phase

1. Scope & Strategy of the assignment is determined
2. Existing security policies and standards are used for defining the scope

Step 2) Discovery phase

1. Collect as much information as possible about the system, including data in the system, usernames and even passwords. This is also called fingerprinting
2. Scan and probe into the ports
3. Check for vulnerabilities of the system

Step 3) Attack Phase

1. Find exploits for the various vulnerabilities. You need the necessary security privileges to exploit the system

Step 4) Reporting Phase

1. A report must contain detailed findings
2. Risks of vulnerabilities found and their impact on business
3. Recommendations and solutions, if any

The prime task in penetration testing is to gather system information. There are two ways to gather information:

• ’One to one’ or ’one to many’ model with respect to host: A tester performs techniques in a linear way against either one target host or a logical grouping of target hosts (e.g. a subnet).
• ’Many to one’ or ’many to many’ model: The tester utilizes multiple hosts to execute information gathering techniques in a random, rate-limited and non-linear fashion.

Examples of Penetration Testing Tools

There is a wide variety of tools that are used in penetration testing, and the important Pentest tools are:

1) Teramind

Teramind delivers a comprehensive suite for insider threat prevention and employee monitoring. It enhances security through behavior analytics and data loss prevention, ensuring compliance and optimizing business processes. Its customizable platform suits various organizational needs, providing actionable insights that focus on boosting productivity and safeguarding data integrity.

Features:

• Insider Threat Prevention: Detects and prevents user actions that may indicate insider threats to data.
• Business Process Optimization: Utilizes data-driven behavior analytics to redefine operational processes.
• Workforce Productivity: Monitors productivity, security, and compliance behaviors of the workforce.
• Compliance Management: Helps manage compliance with a single, scalable solution suitable for small businesses, enterprises, and government agencies.
• Incident Forensics: Provides evidence to enrich incident response, investigations, and threat intelligence.
• Data Loss Prevention: Monitors and protects against the potential loss of sensitive data.
• Employee Monitoring: Offers capabilities to monitor employee performance and activities.
• Behavioral Analytics: Analyzes granular customer app behavior data for insights.
• Customizable Monitoring Settings: Allows customization of monitoring settings to suit specific use cases or to implement predefined rules.
• Dashboard Insights: Provides visibility and actionable insights into workforce activities through a comprehensive dashboard.

Visit Teramind >>

1. NMap – This tool is used to do port scanning, OS identification, trace the route and vulnerability scanning.
2. Nessus – This is a traditional network-based vulnerabilities tool.
3. Pass-The-Hash – This tool is mainly used for password cracking.

Role and Responsibilities of Penetration Testers

A penetration tester’s job is to:

• Collect the required information from the organization to enable penetration tests
• Find flaws that could allow hackers to attack a target machine
• Think and act like real hackers, albeit ethically
• Make the work reproducible, so that it will be easy for developers to fix it
• Agree the start date and end date of test execution in advance
• Take responsibility for any loss in the system or information during the software testing
• Keep data and information confidential

Manual Penetration Testing vs. Automated Penetration Testing

Most real engagements mix both approaches. The comparison below shows where each one earns its place.

Manual Penetration Testing	Automated Penetration Testing
Manual Testing requires expert professionals to run the tests	Automated test tools provide clear reports with less experienced professionals
Manual Testing requires Excel and other tools to track it	Automation Testing has centralized and standard tools
In Manual Testing, sample results vary from test to test	In the case of Automated Tests, results do not vary from test to test
Memory cleaning up should be remembered by users	Automated Testing will have comprehensive cleanups.

Disadvantages of Penetration Testing

Penetration testing cannot find all vulnerabilities in the system. There are limitations of time, budget, scope and the skills of the penetration testers.

The following will be side effects when we are doing penetration testing:

• Data Loss and Corruption
• Down Time
• Increase Costs

The infographic below collects the same trade-offs, alongside the reasons organizations run the test anyway.

These limits are the reason a penetration test works best on top of a well-implemented security policy rather than in place of one. Testers should act like real hackers, check whether the code is securely written, and repeat the exercise on a documented schedule.

FAQs