NetSec Penetration Testing Basics
Penetration testing (pen testing) is an authorized, simulated cyberattack on a system or network performed to evaluate its security. A penetration tester uses the same tools and techniques as a real attacker but with explicit written permission. The goal is to find vulnerabilities before a real attacker does and provide actionable evidence of exactly how an attacker would exploit them.
Pen Testing vs Vulnerability Assessment
Vulnerability Assessment: Penetration Test: Scans for known vulnerabilities. Actively exploits vulnerabilities. Reports: "Port 3389 is open." Reports: "I used port 3389 to gain No exploitation occurs. domain admin access in 4 hours." Lower risk, faster, less expensive. Higher risk, longer, more expensive. Tells you WHAT the problems are. Shows you HOW bad the problems are.
Types of Penetration Tests
Black Box Test
The tester gets no information about the target — just the organization's name or a domain name. This simulates an external attacker who starts from scratch. It tests how well the organization's defenses hold against a motivated outsider with no insider knowledge.
White Box Test
The tester receives full documentation: network diagrams, source code, system architecture, and credentials. This allows a comprehensive and efficient assessment — every component gets tested thoroughly. It simulates an attacker with full insider knowledge or a stolen employee laptop.
Grey Box Test
The tester receives partial information — perhaps a standard employee account and a high-level network diagram. This simulates a compromised low-privilege account or a scenario where an attacker has gathered some information through reconnaissance. It balances realism with efficiency.
The Penetration Testing Methodology
PHASE 1: PLANNING AND SCOPING
↓ Define what systems are in scope
↓ Get signed authorization (Rules of Engagement)
↓ Define testing timeframes and emergency contacts
↓ Agree on notification procedures if critical vulnerabilities found
PHASE 2: RECONNAISSANCE
↓ Passive: Gather info without touching target
(WHOIS, DNS records, job postings, LinkedIn, leaked data)
↓ Active: Probe the target directly
(DNS enumeration, port scanning, OS fingerprinting)
PHASE 3: SCANNING AND ENUMERATION
↓ Identify open ports and running services
↓ Identify software versions (for known CVEs)
↓ Map network topology
↓ Discover user accounts, shares, email addresses
PHASE 4: EXPLOITATION
↓ Attempt to exploit discovered vulnerabilities
↓ Bypass authentication controls
↓ Escalate privileges (local user → admin → domain admin)
↓ Move laterally to other systems
PHASE 5: POST-EXPLOITATION
↓ Determine what can be accessed with achieved access
↓ Attempt to reach defined "crown jewel" targets
↓ Document evidence without causing damage
PHASE 6: REPORTING
↓ Document all findings with evidence (screenshots, logs)
↓ Rate each finding by severity (Critical/High/Medium/Low)
↓ Provide remediation recommendations
↓ Present findings to technical team and management
Tools Used in Penetration Testing
Category | Tool | Purpose --------------------|--------------------|--------------------------------- Network scanner | Nmap | Port scanning, service detection Vulnerability scan | Nessus, OpenVAS | Find known vulnerabilities Exploitation | Metasploit | Exploit known vulnerabilities Password attack | Hashcat, John | Crack captured password hashes Web app testing | Burp Suite | Intercept and modify web requests Wireless testing | Aircrack-ng | Crack WEP/WPA2 PSK MITM | Ettercap, Bettercap| ARP poisoning, traffic intercept Packet capture | Wireshark | Analyze network traffic Privilege escalation| WinPEAS, LinPEAS | Find local privilege escalation paths Active Directory | BloodHound | Map AD attack paths
The Rules of Engagement
The Rules of Engagement (RoE) document defines exactly what the tester is and is not allowed to do. Every pen test must have a signed RoE before any testing begins.
Rules of Engagement Contents: ┌─────────────────────────────────────────────────────────┐ │ PENETRATION TEST AUTHORIZATION │ │ │ │ Client: AcmeCorp Ltd │ │ Testing firm: SecurePen LLC │ │ Test dates: 2024-04-01 to 2024-04-05 │ │ │ │ IN SCOPE: │ │ • 203.0.113.0/24 (external IP range) │ │ • acmecorp.com and all subdomains │ │ • VPN concentrator: 203.0.113.10 │ │ │ │ OUT OF SCOPE: │ │ • Production payment processing systems │ │ • Customer database (10.0.5.0/24) │ │ • Physical premises │ │ │ │ PROHIBITED ACTIONS: │ │ • DoS attacks on any system │ │ • Data exfiltration of real customer data │ │ • Destructive testing │ │ │ │ EMERGENCY CONTACT: John Smith +1-555-0100 │ └─────────────────────────────────────────────────────────┘
Pen Test Report Structure
Section 1: Executive Summary • High-level findings in non-technical language • Overall risk rating • Most critical issues requiring immediate attention Section 2: Technical Findings For each vulnerability: • Finding name and severity (Critical/High/Medium/Low) • Affected systems • Description of the vulnerability • Evidence (screenshot, command output, packet capture) • Steps to reproduce • Remediation recommendation Section 3: Attack Chain • Step-by-step narrative of how deep access was achieved • Demonstrates real-world impact Section 4: Positive Findings • Controls that worked as expected during the test
A penetration test is one of the most valuable investments a security team can make. It converts theoretical vulnerabilities into concrete evidence of real-world exploitability. Executives and board members who struggle to understand abstract risk ratings immediately understand "the tester gained access to our customer database in three hours using freely available tools."