Penetration Testing

About the Tutorial

Penetration Testing is used to find flaws in the system in order to take appropriate security
measures to protect the data and maintain functionality. This tutorial provides a quick
glimpse of the core concepts of Penetration Testing.

Audience
This tutorial has been prepared for beginners to help them understand the basics of
Penetration Testing and how to use it in practice.

Prerequisites
Before proceeding with this tutorial, you should have a basic understanding of software
testing and its related concepts.

Copyright & Disclaimer

 Copyright 2018 by Tutorials Point (I) Pvt. Ltd.

All the content and graphics published in this e-book are the property of Tutorials Point (I)
Pvt. Ltd. The user of this e-book is prohibited to reuse, retain, copy, distribute or republish
any contents or a part of contents of this e-book in any manner without written consent
of the publisher.

We strive to update the contents of our website and tutorials as timely and as precisely as
possible, however, the contents may contain inaccuracies or errors. Tutorials Point (I) Pvt.
Ltd. provides no guarantee regarding the accuracy, timeliness or completeness of our
website or its contents including this tutorial. If you discover any errors on our website or
in this tutorial, please notify us at contact@tutorialspoint.com

i
 Penetration Testing

Table of Contents
About the Tutorial .................................................................................................................................... i

Audience .................................................................................................................................................. i

Prerequisites ............................................................................................................................................ i

Copyright & Disclaimer ............................................................................................................................. i

Table of Contents .................................................................................................................................... ii

1. PENETRATION TESTING — INTRODUCTION ......................................................................... 1

What is Penetration Testing? .................................................................................................................. 1

Why is Penetration Testing Required? .................................................................................................... 1

When to Perform Penetration Testing? ................................................................................................... 1

How is Penetration Testing Beneficial? ................................................................................................... 2

2. PENETRATION TESTING — PENETRATION TESTING METHOD.............................................. 3

Steps of Penetration Testing Method ...................................................................................................... 3

Planning & Preparation ........................................................................................................................... 4

Reconnaissance ....................................................................................................................................... 4

Discovery ................................................................................................................................................ 4

Analyzing Information and Risks ............................................................................................................. 4

Active Intrusion Attempts ....................................................................................................................... 5

Final Analysis .......................................................................................................................................... 5

Report Preparation ................................................................................................................................. 5

3. PENETRATION TESTING — PENETRATION TESTING VS. VULNERABILITY ASSESSMENT ........ 6

Penetration Testing ................................................................................................................................ 6

Vulnerability Assessment ........................................................................................................................ 6

Which Option is Ideal to Practice? ........................................................................................................... 7

4. PENETRATION TESTING — TYPES OF PENETRATION TESTING.............................................. 8

Types of Pen Testing ............................................................................................................................... 8

ii
 Penetration Testing

Black Box Penetration Testing ................................................................................................................. 8

White Box Penetration Testing................................................................................................................ 9

Grey Box Penetration Testing .................................................................................................................. 9

Areas of Penetration Testing ................................................................................................................. 10

5. PENETRATION TESTING — MANUAL AND AUTOMATED .................................................... 11

What is Manual Penetration Testing? ................................................................................................... 11

Types of Manual Penetration Testing .................................................................................................... 12

What is Automated Penetration Testing? ............................................................................................. 12

6. PENETRATION TESTING — PENETRATION TESTING TOOLS ................................................ 14

What are Penetration Testing Tools? .................................................................................................... 14

7. PENETRATION TESTING — INFRASTRUCTURE PENETRATION TESTING .............................. 16

What is Infrastructure Penetration Testing? ......................................................................................... 16

Types of Infrastructure Penetration Testing .......................................................................................... 16

External Infrastructure Testing .............................................................................................................. 17

Internal Infrastructure Penetration Testing ........................................................................................... 17

Cloud and Virtualization Penetration Testing ........................................................................................ 17

Wireless Security Penetration Testing ................................................................................................... 18

8. PENETRATION TESTING — PENETRATION TESTERS ........................................................... 19

Qualification of Penetration Testers...................................................................................................... 19

Role of a Penetration Tester .................................................................................................................. 20

9. PENETRATION TESTING — REPORT WRITING .................................................................... 21

What is Report Writing? ........................................................................................................................ 21

Report Writing Stages ........................................................................................................................... 21

Report Planning .................................................................................................................................... 21

Information Collection .......................................................................................................................... 22

iii
 Penetration Testing

Writing the First Draft ........................................................................................................................... 22

Review and Finalization ........................................................................................................................ 22

Content of Penetration Testing Report.................................................................................................. 23

10. PENETRATION TESTING — ETHICAL HACKING ................................................................... 24

Who are Ethical Hackers? ...................................................................................................................... 24

Who are Criminal Hackers? ................................................................................................................... 24

What can Criminal Hackers do? ............................................................................................................. 24

What are the Skill-Sets of Ethical Hackers?............................................................................................ 26

What do Ethical Hackers do? ................................................................................................................. 26

Types of Hackers ................................................................................................................................... 26

11. PENETRATION TESTING — PENETRATION TESTING VS. ETHICAL HACKING ........................ 28

Penetration Testing ............................................................................................................................... 28

Ethical Hacking ...................................................................................................................................... 28

12. PENETRATION TESTING — LIMITATIONS ........................................................................... 30

13. PENETRATION TESTING — REMEDIATION ......................................................................... 32

14. PENETRATION TESTING — LEGAL ISSUES .......................................................................... 33

iv
 Penetration Testing
1. Penetration Testing — Introduction

What is Penetration Testing?

Penetration testing is a type of security testing that is used to test the insecurity of an
application. It is conducted to find the security risk which might be present in the system.

If a system is not secured, then any attacker can disrupt or take authorized access to that
system. Security risk is normally an accidental error that occurs while developing and
implementing the software. For example, configuration errors, design errors, and software
bugs, etc.

Why is Penetration Testing Required?

Penetration testing normally evaluates a system’s ability to protect its networks,
applications, endpoints and users from external or internal threats. It also attempts to
protect the security controls and ensures only authorized access.

Penetration testing is essential because:

 It identifies a simulation environment i.e., how an intruder may attack the system
through white hat attack.

 It helps to find weak areas where an intruder can attack to gain access to the
computer’s features and data.

 It supports to avoid black hat attack and protects the original data.

 It estimates the magnitude of the attack on potential business.

 It provides evidence to suggest, why it is important to increase investments in

security aspect of technology.

When to Perform Penetration Testing?

Penetration testing is an essential feature that needs to be performed regularly for
securing the functioning of a system. In addition to this, it should be performed whenever:

 Security system discovers new threats by attackers.

 You add a new network infrastructure.

 You update your system or install new software.

 You relocate your office.

 You set up a new end-user program/policy.

1
 Penetration Testing

How is Penetration Testing Beneficial?

Penetration testing offers the following benefits::

 Enhancement of the Management System: It provides detailed information

about the security threats. In addition to this, it also categorizes the degree of
vulnerabilities and suggests you, which one is more vulnerable and which one is
less. So, you can easily and accurately manage your security system by allocating
the security resources accordingly.

 Avoid Fines: Penetration testing keeps your organization’s major activities

updated and complies with the auditing system. So, penetration testing protects
you from giving fines.

 Protection from Financial Damage: A simple breach of security system may

cause millions of dollars of damage. Penetration testing can protect your
organization from such damages.

 Customer Protection: Breach of even a single customer’s data may cause big
financial damage as well as reputation damage. It protects the organizations who
deal with the customers and keep their data intact.

2
 Penetration Testing
2. Penetration Testing — Penetration Testing Method

Penetration testing is a combination of techniques that considers various issues of the

systems and tests, analyzes, and gives solutions. It is based on a structured procedure
that performs penetration testing step-by-step.

This chapter describes various steps or phases of penetration testing method.

Steps of Penetration Testing Method

The following are the seven steps of penetration testing:

Planning & Preparation

Reconnaissance

Discovery

Analyzing information and risks

Active intrusion attempts

Final analysis

Report Preparation

3
 Penetration Testing

End of ebook preview

If you liked what you saw…
Buy it from our store @ https://store.tutorialspoint.com