Penetration testing is the act of checking computer systems for exploitable vulnerabilities and other security risks. A penetration test or Pen test is usually undertaken by ethical hackers to find vulnerabilities in computer systems. Organizations hire professional hackers to pen-test their systems using Pentesting tools before malicious attackers do so. To test the organization’s system, Ethical Hacker performs vulnerability assessment and/or penetration testing through both external and internal attacks that are intended to break the system security just as attackers do, but the attacker in tents after this step is to steal or damage data or disrupt normal function the system. Penetration testing is related to ethical hacking but can be used interchangeably, Ethical hacking covers all areas of hacking and techniques used in hacking, cyber crimes, and other related cyber attack techniques.
                   Types of Penetration Testing
- Network Penetration Testing
- Web Penetration Testing
- Host / Server Penetration Testing
- Mobile Penetration Testing
The type of penetration testing depends on the organization’s requirements. The followings are major conditions for Penetration testing.
- Black Box Penetration Testing: Black box penetration testing is a type of test conducted without prior information, meaning that the organization does not any information to a penetration tester before doing the job. The penetration tester is responsible or agreed on gathering information by himself to carry out the test on the organization’s system.
- White Box Penetration Testing: White Box Penetration Testing (also known as clear box and open box testing) is when an organization provides some information or a whole range of information about the systems and/or network such as Username, running service, OS details, IP address, etc. This information is provided before carrying out the test.
- Gray Box Penetration Testing: Gray Box Penetration Testing is a type of testing in which partial or limited information about the system is provided to a penetration tester before the test. This type of test is usually carried out by an illicit external hacker who does not have full details about the organization’s system, but trying to gain access to an organization’s system/network with the limited information illegally acquired.
                     Penetration testing stages
The penetration testing process can be separated into five phases. The followings are stages in pen-testing.
- Planning and reconnaissance: This is the first stage of penetration testing in which goals and objectives are set for the penetration testing, documenting and identifying of the systems, gathering of information about the systems/network and the testing methods to be used for scanning to know all possible vulnerabilities and other security risks.
- Scanning: Scanning is the second stage, a penetration tester uses automated pen testing tools to scan target assets for discovering vulnerabilities. The pentester discovers additional systems, servers, and other devices that determine open ports and running services.
- Gaining access: This is a stage where the penetration tester makes an active attempt at the target’s vulnerabilities. Tester exploits these vulnerabilities, typically bypassing authentication, intercepting traffic, etc.
- Maintaining access: The goal of this stage is to achieve a persistent presence and remain undetectable in the exploited system using a backdoor.
- Analysis and Report: In this stage, penetration tests are reviewed and documented in a report detailing. Information in a report may include vulnerabilities that were exploited, data that was accessed, and the amount of time taken that remain undetectable.
Penetration testing and report writing is an important and comprehensive task that clarifies the organization about the security risk and solution that must be must be carried out. The report must also include a proper explanation of the report content and design, risks and critical vulnerabilities discovered and countermeasures that must take place, detailed examples of testing reports, and the penetration tester’s personal experience.
