What is Pen Testing ?
Penetration testing, aka pen testing or ethical hacking, attempts to breach a system’s security for the purpose of vulnerability identification.
n most cases, both humans and automated programs research, probe, and attack a network using various methods and channels. Once inside the network, penetration testers will see exactly how deep they can get into a network with the ultimate goal of achieving full administrative access, or “root.”
While this may sound frightening, it’s a growing trend that some of the biggest companies worldwide use to stay one step ahead of malicious actors. By purposely attacking your own network, you discover your organization’s vulnerabilities before a potential breach.
How Does Pentesting Work?
Pen testing utilizes ethical hackers to put themselves in the shoes of malicious actors. Network owners establish a specific pentesting scope that specifies what systems are eligible for testing and the test timeframe.
Determining scope sets guidelines and sets the tone and limitations for what the testers can and cannot do. After a scope and timeframe have been established, the ethical hackers get to work scanning for ways into the network.
Pentesting Techniques
There are few types of Pentesting Techniques available
Black Box
Black box testing, also referred to as external penetration testing, gives the ethical hacker little to no early information about the IT infrastructure or security of the company beforehand. Black box tests are often used to simulate an actual cyberattack.
Tests start from outside the network where the tester doesn’t know about in-place security systems or local network architecture. Since the simulated attack is blind, these tests can be the most time-consuming.
White Box
White box testing is where the tester has full knowledge of the network infrastructure and security systems in place. While these tests don’t mimic what a real outside attack might look like, they are one of the most thorough types of tests you can have performed.
White box tests can also simulate what an inside attack may look like since the tester starts inside the network with insider knowledge of how the network is structured. While white box testing can be completed quickly due to its transparent nature, enterprise organizations with many applications to test may still have to wait several months for complete results.
Gray Box
Gray box is a blend of the first two techniques and allows the tester partial access or knowledge into the company network. Gray box is often used when testing a specific public-facing application with a private server backend. With this combined information, the tester can attempt to exploit specific services to gain unauthorized access into other parts of the network.
The timeframe for a gray box test is usually less than a black box test, but longer than a white box test due to the testers’ limited network knowledge of the network.
Pentest Target
Different areas of a company that may get penetration tested include:
- Web applications
- Wireless networks
- Physical infrastructure
- Social engineering
- Reconnaissance
- Wireless Attacks
- Vulnerablity Scanning
- Social engineering
- Brute Force Attack
- Reverse Engineering
- Exploitation
- Post Exploitation
- Web App Pen Testing
- Reporting & Documetation
Services
- Secure Private Cloud
- Programming
- Secure Websites
- Linux Security
- Windows Security