A penetration test is a subclass of ethical hacking; it comprises a set of methods and procedures
that aim at testing/protecting an organization’s security. The penetration tests prove helpful in
finding vulnerabilities in an organization and check whether an attacker will be able to exploit
them to gain unauthorized access to an asset.
Vulnerability Assessments versus Penetration Test
Oftentimes, a vulnerability assessment is confused with a penetration test; however, these terms
have completely different meanings. In a vulnerability assessment, our goal is to figure out all the
vulnerabilities in an asset and document them accordingly.
In a penetration test, however, we need to simulate as an attacker to see if we are actually able
to exploit a vulnerability and document the vulnerabilities that were exploited and the ones that
turned out to be false-positive.
Pre engagement
Before you start doing a penetration test, there is whole lot of things you need to discuss with
clients. This is the phase where both the customer and a representative from your company would
sit down and discuss about the legal requirements and the “rules of engagement.”
Penetration testing Methodologies
In every penetration test, methodology and the reporting are the most important steps. Let’s first
talk about the methodology. There are several different types of penetration testing methodologies
that address how a penetration test should be performed. Some of them are discussed in brief next.
OSSTMM {open-source security testing methodology manual (OSSTMM)}
An open-source security testing methodology manual (OSSTMM) basically includes almost all
the steps involved in a penetration test. The methodology employed for penetration test is concise yet it’s a cumbersome process which makes it difficult to implement it in our everyday life.
Penetration tests, despite being tedious, demands a great deal of money out of company’s budgets
for their completion which often are not met by a large number of organizations.
NIST
NIST, on the other hand, is more comprehensive than OSSTMM, and it’s something that you
would be able to apply on a daily basis and in short engagements. The screenshot indicates the four
steps of the methodology, namely, planning, discovery, attack, and reporting.
The testing starts with the planning phase, where how the engagement is going to be performed
is decided upon. This is followed by the discovery phase, which is divided into two parts—the first
part includes information gathering, network scanning, service identification, and OS detection,
and the second part involves vulnerability assessment.
After the discovery phase comes the attack phase, which is the heart of every penetration test. If
you are able to compromise a target and a new host is discovered, in case the system is dual-homed
or is connected with multiple interfaces, you would go back to step 2, that is, discovery, and repeat it
until no targets are left. The indicating arrows in the block phase and the attack phase to the reporting
phase indicate that you plan something and you report it—you attack a target and report the results.
OWASP
As you might have noticed, both the methodologies focused more on performing a network penetration test rather than something specifically built for testing web applications. The OWASP
testing methodology is what we follow for all “application penetration tests” we do here at the
RHA Info SEC. The OWASP testing guide basically contains almost everything that you would
test a web application for. The methodology is comprehensive and is designed by some of the best
web application security researchers.
Types of Penetration Tests
There are several types of penetration tests; however, the following are the ones most commonly
performed:
Network Penetration Test
In a network penetration test, you would be testing a network environment for potential security
vulnerabilities and threats. This test is divided into two categories: external and internal penetration tests.
An external penetration test would involve testing the public IP addresses, whereas in an internal test, you can become part of an internal network and test that network. You may be provided
VPN access to the network or would have to physically go to the work environment for the penetration test depending upon the engagement rules that were defined prior to conducting the test.
Web Application Penetration Test
Web application penetration test is very common nowadays, since your application hosts critical
data such as credit card numbers, usernames, and passwords; therefore this type of penetration test
has become more common than the network penetration test.
Mobile Application Penetration Test
The mobile application penetration test is the newest type of penetration test that has become
common since almost every organization uses Android- and iOS-based mobile applications to
provide services to its customers. Therefore, organizations want to make sure that their mobile
applications are secure enough for users to rely on when providing personal information when
using such applications.
Social Engineering Penetration Test
A social engineering penetration test can be part of a network penetration test. In a social engineering penetration test the organization may ask you to attack its users. This is where you use
speared phishing attacks and browser exploits to trick a user into doing things they did not intend
to do.
Physical Penetration Test
A physical penetration test is what you would rarely be doing in your career as a penetration tester.
In a physical penetration test, you would be asked to walk into the organization’s building physically and test physical security controls such as locks and RFID mechanisms.
Comments
Post a Comment