Let's start with the basics and answer the main question:

What's Penetration Testing?

Penetration Testing (or PenTesting) is an assessment whose objective is to evaluate the actual security level of a target.

Well, what's a security assessment then?

Security assessments are a wider category of audits, they have the same objective: assess the security of a target, but penetration testing is a specific kind of security assessment focused on practice and actually exploitable vulnerabilities.

• Vulnerability audits, ISO27001 audits and code reviews are other examples of security assessments, but contrary to Penetration Tests, they do not include actual exploitation, just theoretical evaluation.

Note: The main difference between a PenTest and other kinds of security assessments is that during a pentest the auditor(s) actually exploit the vulnerability as much as they can.

How does a PenTest usually unfolds?

What happens after a client contacts a company and asks for a PenTest?

Pre-Assessment

First of all, before starting on the technical parts, we need to understand the client's needs and draft an audit plan:

• Why do they want to be audited?
• Do they need to be audited for a certification? Regulatory reasons?
• What should be audited, how?
• When the audit should take place?
• Who should be contacted during the audit?

Types of PenTests

We usually distinguish between three types of pentest setups:

• Black Box - In a black-box assessment, the auditor(s) only have the minimal information possible for the audit, usually a domain name or an IP range. It is the most realistic pentest setup for external attacks.
• White Box - In a white-box assessment, the auditor(s) have access to anything they might need, admin accounts, user accounts, technical documentation, source code if required. It is the most exhaustive audit setup, covering internal attacks too.
• Gray Box - Inbetween the black and white box assessments, the auditor(s) usually have access to some information but not everything, for instance a few user accounts with low privileges.

Then, every important information will be compiled in a contract or authorization document to precisely frame the upcoming audit.

Having written permission from the client is the most important requirement before starting any technical assessment.

Note: Legally, if you do not have a precise and signed document to prove that you are allowed to attack a specific target, your exploitation attempts could lead to huge legal issues. Even if a client contacted you to audit them!

Once you're done with the preparation, you can move on to the techncial parts!

Reconnaissance

In the recon phase, you will gather as much publicly available information (or OSint) as you can, including:

• E-mail addresses
• Phone numbers
• Names and roles of the people in the organization
• IP addresses
• Technological stack information
• Version numbers
• Vulnerabilities (theorical, based on the version number and online information)

And basically anything else that could be useful to plan a future intrusion attempt!

Scan

During the scan phase of a PenTest, you will use scanners to try to discover live hosts and ports, you will run nmap, rustscan and other scanners to find:

• Live IP addresses
• Open TCP/UDP ports
• Services with exposed version numbers

This step's goal is also to validate the information we already discovered during the recon phase, you found a HTTP server version number on Shodan? Verify it with nmap to make sure that it's actually up to date and accurate!

Enumeration

During the enumeration phase, the auditor(s) will actually communicate with the services discovered during the scan phase.

They will use enumeration tools that know how to use the protocols for specific services (SMB, DNS, SMTP, FTP, SNMP etc...) to find:

• Users
• Groups
• Running software on hosts
• Password policies
• Email addresses
• IP addresses
• Group and Users permissions
• Accessible file shares

With all of the information gathered up to this point, the auditor(s) can move on to the phase where they actually break things!

Exploitation

In the exploitation phase, you will use actuall hacker techniques to try to gain access to resource onto the target systems and answer the question: "What can a malicious person actually do to our current infrastructure?".

You will use techniques such as:

• Logic Errors exploitation
• Denial of Service attacks
• Injections (XSS, SQL, CSV, XML etc...)
• Buffer Overflows
• Bruteforce
• Credential Stuffing

And more!

Now that we've covered the theory, let's answer a few questions before moving on to the practice.