A penetration test, or “pen test,” is a security test that launches a mock cyberattack to find vulnerabilities in a computer system.
Penetration testers are security professionals skilled in the art of ethical hacking, which is the use of hacking tools and techniques to fix security weaknesses rather than cause harm. Companies hire pen testers to launch simulated attacks against their apps, networks, and other assets. By staging fake attacks, pen testers help security teams uncover critical security vulnerabilities and improve the overall security posture.
The terms “ethical hacking” and “penetration testing” are sometimes used interchangeably, but there is a difference. Ethical hacking is a broader cybersecurity field that includes any use of hacking skills to improve network security. Penetration tests are just one of the methods ethical hackers use. Ethical hackers may also provide malware analysis, risk assessment, and other services.
Why is penetration testing important?
Penetration testing helps an organization discover vulnerabilities and flaws in their systems that they might not have otherwise been able to find. This can help stop attacks before they start, as organizations can fix these vulnerabilities once they have been identified.
How much access is given to pen testers?
Depending on the goals of a pen test, testers are given varying degrees of information about, or access to, the target system. In some cases, the pen testing team takes one approach at the start and sticks with it. Other times, the testing team evolves its strategy as its awareness of the system increases during the pen test. There are three levels of pen test access.
- Opaque box. The team doesn’t know anything about the internal structure of the target system. It acts as hackers would, probing for any externally exploitable weaknesses.
- Semi-opaque box. The team has some knowledge of one or more sets of credentials. It also knows about the target’s internal data structures, code, and algorithms. Pen testers might construct test cases based on detailed design documents, such as architectural diagrams of the target system.
- Transparent box. Pen testers have access to systems and system artifacts including source code, binaries, containers, and sometimes even the servers running the system. This approach provides the highest level of assurance in the smallest amount of time.
What are the types of pen testing?
A comprehensive approach to pen testing is essential for optimal risk management. This entails testing all the areas in your environment.
- Web apps. Testers examine the effectiveness of security controls and look for hidden vulnerabilities, attack patterns, and any other potential security gaps that can lead to a compromise of a web app.
- Mobile apps. Using both automated and extended manual testing, testers look for vulnerabilities in application binaries running on the mobile device and the corresponding server-side functionality. Server-side vulnerabilities include session management, cryptographic issues, authentication and authorization issues, and other common web service vulnerabilities.
- Networks. This testing identifies common to critical security vulnerabilities in an external network and systems. Experts employ a checklist that includes test cases for encrypted transport protocols, SSL certificate scoping issues, use of administrative services, and more.
- Cloud. A cloud environment is significantly different than traditional on-premises environments. Typically, security responsibilities are shared between the organization using the environment and the cloud services provider. Because of this, cloud pen testing requires a set of specialized skills and experience to scrutinize the various aspects of the cloud, such as configurations, APIs, various databases, encryption, storage, and security controls.
- Containers. Containers obtained from Docker often have vulnerabilities that can be exploited at scale. Misconfiguration is also a common risk associated with containers and their environment. Both of these risks can be uncovered with expert pen testing.
- Embedded devices (IoT). Embedded / Internet of Things (IoT) devices such as medical devices, automobiles, in-home appliances, oil rig equipment, and watches have unique software testing requirements due to their longer life cycles, remote locations, power constraints, regulatory requirements, and more. Experts perform a thorough communication analysis along with a client/server analysis to identify defects that matter most to the relevant use case.
- Mobile devices. Pen testers use both automated and manual analysis to find vulnerabilities in application binaries running on the mobile device and the corresponding server-side functionality. Vulnerabilities in application binaries can include authentication and authorization issues, client-side trust issues, misconfigured security controls, and cross-platform development framework issues. Server-side vulnerabilities can include session management, cryptographic issues, authentication and authorization issues, and other common web service vulnerabilities.
- APIs. Both automated and manual testing techniques are used to cover the OWASP API Security Top 10 list. Some of the security risks and vulnerabilities testers look for include broken object level authorization, user authentication, excessive data exposure, lack of resources / rate limiting, and more.
- CI/CD pipeline. Modern DevSecOps practices integrate automated and intelligent code scanning tools into the CI/CD pipeline. In addition to static tools that find known vulnerabilities, automated pen testing tools can be integrated into the CI/CD pipeline to mimic what a hacker can do to compromise the security of an application. Automated CI/CD pen testing can discover hidden vulnerabilities and attack patterns that go undetected with static code scanning.
The penetration testing process
Before a pen test begins, the testing team and the company set a scope for the test. The scope outlines which systems will be tested, when the testing will happen, and the methods pen testers can use. The scope also determines how much information the pen testers will have ahead of time:
- In a black-box test, pen testers have no information about the target system. They must rely on their own research to develop an attack plan, as a real-world hacker would.
- In a white-box test, pen testers have total transparency into the target system. The company shares details like network diagrams, source codes, credentials, and more.
- In a gray-box test, pen testers get some information but not much. For example, the company might share IP ranges for network devices, but the pen testers have to probe those IP ranges for vulnerabilities on their own.
With a scope set, testing begins. Pen testers may follow several pen testing methodologies. Common ones include OWASP’s application security testing guidelines (link resides outside ibm.com), the Penetration Testing Execution Standard (PTES) (link resides outside ibm.com), and the National Institute of Standards and Technology (NIST) SP 800-115 (link resides outside ibm.com).
Regardless of which methodology a testing team uses, the process usually follows the same overall steps.
1. Reconnaissance
The testing team gathers information on the target system. Pen testers use different recon methods depending on the target. For example, if the target is an app, pen testers might study its source code. If the target is an entire network, pen testers might use a packet analyzer to inspect network traffic flows.
Pen testers often draw on open source intelligence (OSINT) as well. By reading public documentation, news articles, and even employees’ social media and GitHub accounts, pen testers can glean valuable information about their targets.
2. Target discovery and development
Pen testers use the knowledge that they gained in the recon step to identify exploitable vulnerabilities in the system. For example, pen testers might use a port scanner like Nmap to look for open ports where they can send malware. For a social engineering pen test, the testing team might develop a fake story, or “pretext,” they use in a phishing email to steal employee credentials.
As part of this step, pen testers may check how security features react to intrusions. For example, they might send suspicious traffic to the company’s firewall to see what happens. Pen testers will use what they learn to avoid detection during the rest of the test.
3. Exploitation
The testing team begins the actual attack. Pen testers may try a variety of attacks depending on the target system, the vulnerabilities they found, and the scope of the test. Some of the most commonly tested attacks include:
- SQL injections: Pen testers try to get a webpage or app to disclose sensitive data by entering malicious code into input fields.
- Cross-site scripting: Pen testers try planting malicious code in a company’s website.
- Denial-of-service attacks: Pen testers try to take servers, apps, and other network resources offline by flooding them with traffic.
- Social engineering: Pen testers use phishing, baiting, pretexting, or other tactics to trick employees into compromising network security.
- Brute force attacks: Pen testers try to break into a system by running scripts that generate and test potential passwords until one works.
- Man-in-the-middle attacks: Pen testers intercept traffic between two devices or users to steal sensitive information or plant malware.
4. Escalation
Once pen testers have exploited a vulnerability to get a foothold in the system, they try to move around and access even more of it. This phase is sometimes called “vulnerability chaining” because pen testers move from vulnerability to vulnerability to get deeper into the network. For example, they might start by planting a keylogger on an employee’s computer. Using that keylogger, they can capture the employee’s credentials. Using those credentials, they can access a sensitive database.
At this stage, the pen tester’s goal is maintaining access and escalating their privileges while evading security measures. Pen testers do all of this to imitate advanced persistent threats (APTs), which can lurk in a system for weeks, months, or years before they’re caught.
5. Cleanup and reporting
At the end of the simulated attack, pen testers clean up any traces they’ve left behind, like back door trojans they planted or configurations they changed. That way, real-world hackers can’t use the pen testers’ exploits to breach the network.
Then, the pen testers prepare a report on the attack. The report typically outlines vulnerabilities that they found, exploits they used, details on how they avoided security features, and descriptions of what they did while inside the system. The report may also include specific recommendations on vulnerability remediation. The in-house security team can use this information to strengthen defenses against real-world attacks.
Penetration testing tools
- Specialized operating systems
- Credential-cracking tools
- Port scanners
- Vulnerability scanners
- Packet analyzers
- Metasploit
Specialized operating systems: Most pen testers use OSs designed for penetration testing and ethical hacking. The most popular is Kali Linux, an opensource Linux distribution that comes preinstalled with pen testing tools like Nmap, Wireshark, and Metasploit.
Credential-cracking tools: These programs can uncover passwords by breaking encryptions or launching brute-force attacks, which use bots or scripts to automatically generate and test potential passwords until one works. Examples include Medusa, Hyrda, Hashcat, and John the Ripper.
Port scanners: Port scanners allow pen testers to remotely test devices for open and available ports, which they can use to breach a network. Nmap is the most widely used port scanner, but masscan and ZMap are also common.
Vulnerability scanners: Vulnerability scanning tools search systems for known vulnerabilities, allowing pen testers to quickly find potential entryways into a target. Examples include Nessus, Core Impact, and Netsparker.
Web vulnerability scanners are a subset of vulnerability scanners that assess web applications and websites. Examples include Burp Suite and OWASP’s Zed Attack Proxy (ZAP).
Packet analyzers: Packet analyzers, also called packet sniffers, allow pen testers to analyze network traffic by capturing and inspecting packets. Pen testers can figure out where traffic is coming from, where it’s going, and — in some cases — what data it contains. Wireshark and tcpdump are among the most commonly used packet analyzers.
Metasploit: Metasploit is a penetration testing framework with a host of functions. Most importantly, Metasploit allows pen testers to automate cyberattacks. Metasploit has a built-in library of prewritten exploit codes and payloads. Pen testers can select an exploit, give it a payload to deliver to the target system, and let Metasploit handle the rest.
How Exactly Does Pentesting Work?
Pen testing utilizes ethical hackers to put themselves in the shoes of malicious actors. Network owners establish a specific pentesting scope that specifies what systems are eligible for testing and the test timeframe.
Determining scope sets guidelines and sets the tone and limitations for what the testers can and cannot do. After a scope and timeframe have been established, the ethical hackers get to work scanning for ways into the network.
Tests usually start with a vulnerability scan that helps identify potential doorways into a network. These vulnerabilities could be anything from misconfigured firewalls to applications that improperly process malformed packets.
Once a system is compromised, the tester can then attempt to gain access to privileged accounts to research deeper into the network and access more critical systems. Pentesters use escalation techniques to investigate a network and explore what a worst-case scenario might be.
Depending on the pentest scope, tests can use several unconventional ways to gain access to networks. One of those techniques is to drop infected USB drives in an organization. If an untrained staff member finds that drive and plugs it into the company network, it could springboard the simulated attack to gain access even faster.
Another often overlooked aspect of cybersecurity is the physical layer. Unlocked doors combined with someone pretending to be IT staff could thwart even the best network security, in some cases resulting in the removal of physical hardware.
After a complete test, a detailed findings report outlines tested processes or systems, compromises found, and recommends remediation action steps. Penetration tests are typically annual and may be performed again after a set of proposed security changes are made.
Types of Pentesting Techniques
Not all penetration tests are performed the same way and may vary depending on the scope of the project and the intended outcome of the test. Let’s explore a few different types of penetration testing techniques.
Black Box
Black box testing, also referred to as external penetration testing, gives the ethical hacker little to no early information about the IT infrastructure or security of the company beforehand. Black box tests are often used to simulate an actual cyberattack.
Tests start from outside the network where the tester doesn’t know about in-place security systems or local network architecture. Since the simulated attack is blind, these tests can be the most time-consuming.
White Box: White box testing is where the tester has full knowledge of the network infrastructure and security systems in place. While these tests don’t mimic what a real outside attack might look like, they are one of the most thorough types of tests you can have performed.White box tests can also simulate what an inside attack may look like since the tester starts inside the network with insider knowledge of how the network is structured. While white box testing can be completed quickly due to its transparent nature, enterprise organizations with many applications to test may still have to wait several months for complete results.
Gray Box:Gray box is a blend of the first two techniques and allows the tester partial access or knowledge into the company network. Gray box is often used when testing a specific public-facing application with a private server backend. With this combined information, the tester can attempt to exploit specific services to gain unauthorized access into other parts of the network.The timeframe for a gray box test is usually less than a black box test, but longer than a white box test due to the testers’ limited network knowledge of the network.
Exactly What Gets Tested in a Pentest?
Penetration tests don’t have to encompass an entire network and focus on specific applications, services, and methodologies. Tests on larger environments can focus on a particular aspect of the network rather than the entire company as a whole. This focus helps organizations budget for upgrades and make time to implement the necessary remediations after a set of smaller pentests without becoming overwhelmed.
Different areas of a company that may get penetration tested include:
- Web applications
- Wireless networks
- Physical infrastructure
- Social engineering
Web Applications
Organizations use web application penetration testing to prevent bad actors from exploiting vulnerabilities on client-facing apps. These tests can vary in complexity due to the vast amount of different browsers, plugins, and extensions that all come into play when running a pen test on a web application.
Web app vulnerabilities can leak sensitive information that may help attackers during the information gathering stage of an attack or get backend access into a specific application.
Agile code can be used to combat these attacks, along with regular testing in sandbox environments on a web development branch. Even after testing and deployment, penetration testers can bring new exploits to light to help companies avoid an actual real attack.
Bug bounty programs are a great way to incentivize ethical hackers to test the latest exploits against different web applications.
Wireless Networks
The inherent openness of Wi-Fi makes it an attractive target for both curious passersby and dedicated attackers. Penetration testers can use many specialized tools that test the reliability and security of different wireless technologies.
Packet sniffers, rogue access points, and deauthentication attacks can be used to hijack wireless sessions and gain a foothold into a private network. Wireless pen testers can also validate the security settings on a guest Wi-Fi network.
For instance, if access rules aren’t configured properly, and the guest network isn’t on its own VLAN, an attacker can potentially gain access to the private network from the guest wireless.
Physical Infrastructure
No security software can stop someone from physically picking up a server and walking out the door with it. While that may seem far-fetched, brazen criminals utilize social engineering to masquerade as technicians, janitors, or guests to gain physical access to sensitive areas.
In a physical penetration test, doors, locks, and other physical controls are put to the test to see how easily bad actors can bypass them. They can be bypassed. Cheap locks and wireless motion detectors are often easily picked or bypassed, while cheap wireless motion detectors can be or fooled with a bit of ingenuity.
If physical restrictions are present, a tester will usually use a series of non-destructive tools to attempt to bypass any locks or sensors that are in place.
Social Engineering
Attackers use social engineering to trick staff members into giving privileged information or access to an organization. This access may be in the form of a phishing email, phone call, or someone physically pretending to be someone they’re not on site.
The ultimate defense against social engineering is knowledgeable and trained staff. Email phishing training has been shown to reduce the number of malicious emails opened. Having policies and procedures in place for visitors can also prevent unauthorized physical access.
Social engineering tests often take place in email or over the phone. Software platforms can be used to send fake phishing emails consistently. Those who click links or reply can be automatically given remediation training. Over time this type of training helps strengthen both the IT infrastructure and the knowledge of all staff members.
Who Are Pentesters?
Penetration testers are trained in many technical and non-technical skills that allow them to professionally and ethically test client networks. Unlike bug bounty hunters, most penetration testers work full-time rather than as freelancers. You’ll often see specialized penetration testing teams made up of members with different skill sets.
Many testers have a deep understanding of programming and know multiple languages that can be used to craft exploits and payloads. In addition to coding, ethical hackers must have a strong knowledge of networking and network protocols. They must understand how real attackers use protocols like DNS, TCP/IP, and DHCP to gain unauthorized access.
Outside of standard technical certifications, there are specialized exams specifically crafted for ethical hackers. One certification called the Certified Ethical Hacker, or CEH, contains 125 multiple choice questions and takes four hours to complete. Many ethical hackers hold this certification alongside other network-related certs.
Penetration testers must also be armed with a set of soft skills to succeed on assignments. Critical thinking and creative problem-solving are a must for ethical hackers, as many attacks will fail or not unfold as expected. Quickly finding creative solutions to challenging problems is part of the job for a penetration tester.
A Piece of a Bigger Puzzle
Penetration testing is only one part of a larger strategy to keep networks secure. Pen testing often occurs over a set period and is complemented by other types of scans and programs that help strengthen the overall security posture of an organization.For example, bug bounty programs offer a continuous way for companies to discover vulnerabilities and improve their network security long after a penetration test has concluded. These programs reward ethical hackers financially when they successfully find and disclose a vulnerability or security flaw.
Bounty payouts usually scale in size depending on the severity of the vulnerability found. Bug bounties act as an evergreen program that continuously challenges the best and brightest minds to put some of the most secure networks to the test. When comparing bug bounty vs. penetration testing, many organizations find that a mix of both offers the best long-term security strategy.
Regular vulnerability scanning can also complement annual penetration testing to help ensure businesses are staying secure between tests. Vulnerability scans can now be automated and run regularly in the background of a network to help detect potential exploits that a bad actor could use to gain a foothold inside a company. Vulnerabilities usually lurk in outdated software, unpatched systems, and misconfigured networking equipment such as routers or switches.
While regular updates can help fix most vulnerable systems, it only takes one unpatched machine to infect an entire network. For example, the Windows BlueKeep vulnerability made it possible for attackers to break into networks using Remote Desktop Protocol. Once inside, an attacker could move laterally within the network and perform privilege escalation to hijack servers, encrypt files, or steal data.
Vulnerability scans help prevent this by identifying these exploits and bringing them to your attention first. Administrators can then work quickly to prioritize the findings and make the necessary changes to fix the issue.
Conclusion
Penetration testing is an essential component of a robust cybersecurity strategy. By simulating real-world attacks, it allows organizations to proactively identify and address vulnerabilities before they can be exploited by malicious actors. This process not only strengthens the overall security posture but also helps in maintaining compliance with industry standards and regulations. As cyber threats continue to evolve, the role of penetration testing becomes increasingly critical in safeguarding sensitive data and ensuring the integrity of IT systems. Investing in regular and thorough penetration testing is a proactive step toward minimizing risks and protecting the organization from potential security breaches.
Thanks for read