Methods Of Pen Testing

• saka
• March 03, 2022
• No Comments

Last updated: Sep 22, 2022

Definition:

Penetration testing, also known as ethical hacking or by its acronym “pen testing”is a security procedure where someone who is an expert in cyber security will attempt to exploit weaknesses in a system.

• The main idea of this assessment is to conduct a simulated attack identifying weak points in a system or software where potential attackers can gain access to and block information about a particular organization or use the information against them.
• An equivalent in an easy to understand term is an individual dressing up as a robber trying to gain access and break into a bank. If he succeeds in breaking in, then the banks are aware that they need to go on to strengthen their security measures and personnel.
• This is the same as a company conducting a pen test on their software, becoming aware of any points of breakthrough.

Extra information:

• When choosing someone to perform the pen-test it is often vitol to use an individual who has little or no prior knowledge about how the system works or how the system is secured.
• As a result of this, it is best to hire external contractors to perform the tests.
• These external individuals are labelled as ethical hackers as they are hired to actually hack into the system, but with the permission of the organisation (and with full knowledge of the owners and leadership in the organization)in order to ensure optimal security and protection over personal, private or important.
• These ethical hackers have great experience in this particular type of field and have either attained advanced degrees or have gone on to self teach themselves how to do so in a completely ethical manner with no bad intentions.
• Conducting a penetration test can take anywhere between one to six weeks to perform in its entirety.
  • It completely depends on the type of penetration test that is conducted in order to determine the amount of time it will take for the whole process to be completed.
  • Additionally, the time it takes will depend on the number of systems being evaluated, examined and checked and the strength of the already existing cybersecurity in the organisation’s systems.

This penetration testing is extremely vital and important to an organisation and therefore should not be something that should be rushed or looked over. This process provides a complete report in understanding any types of weaknesses or vulnerabilities in a system or software and will provide an organisation with a full report about it to help the organization being examined to fix it for their future endeavors.

Reporting findings:

• When it comes to reporting the findings from the penetration test, the owners and leadership are given a full detailed report on how to fix their data breaches for the future.
• They will be explained each and every part that is considered vulnerable or weak.
• The pen-testers will provide some sort of guidance and direction to the owners and leadership to decrease the potential risk of data breach or network/software break ins and also give the owners and leadership advice on how to move forward to a full resolution.

Different pen test reports:

Different penetration testing reports need to be properly tailored to meet the needs of each type of organisation and this is usually based on a few factors.

• Firstly, the set up of the network for this particular type of organisation.
• Secondly the objectives of the business when they decided to conduct a pen test.
• Thirdly, the report will be based on what exactly is being tested, is it the software? The endpoints? The servers? Or the physical controls?
• Lastly, the report will be based on the value of the intagile or even the tangible assets being secured by the organisation. The list of what the reports would be based on goes on for a long time! 

Different ways to conduct a pen test:

There are different ways to conduct penetration testing and in this article I will go on to highlight the six main types. It is important to note that not all types work for all different businesses thus it is important to figure out which one is best suited for you.

• Firstly, there is “external network penetration”.
  • This form of penetration testing examines the wealth currently available for public information.
  • The team assessing will try to highlight vulnerabilities that they have found whilst conducting this test.
  • For example, an external pentester might break into an organisation’s firewall or attempt to utilise public or private data collected from leaked data breaches which might target internet-facing infrastructure.
• The second type of penetration testing is “internal network penetration testing”.
  • Some of these ethical hackers might begin to search for internal vulnerabilities.
  • The hacker takes on the role of a bad or malicious “insider” or in fact an employee who has negative intentions for the organisation.
  • There are many employees who might be holding some sort of grudge and this is important information for a company to know.
  • In this type of pen-test, the pentester displays what might occur is a malicious employee or a cybercriminal who is pretending to be a staff member, might attempt to attack from inside the company.
  • These ethical hackers determine the level of impact of important and private information being spread out unwillingly, used in the wrong way, changed to a certain extent or even destroyed.
  • The pen-testers use this information to recommend better security.
• The third type of penetration testing is “social engineering testing”.
  • This form assesses how allowing a staff member is to reveal private and important information.
  • This type of testing pushes to gain the trust of a particular employee and manipulate or trick them into sharing confidential information.
  • An example of this is “phishing emails” which are utilised as a social engineering ploy.
  • What the hacker might do is pretend to be a staff members manager, sending an email from an almost identical email address and request that an employee transfers a large sum of money to them or shares a private login.
  • If the employee gives in, this might reveal that employees need deeper security training and security management.
• The fourth type of penetration testing is “physical penetration testing”.
  • These sort of attacks are as the name states, physical, rather than digital ones.
  • These types of penetration tests imitate what a physical breaking of security might look like by a hacker or intruder.
  • The individual doing this assessment might show up looking like a delivery man who is attempting to gain entrance into the building or the office where the organisation works.
• The fifth type of penetration testing is “wireless penetration testing”.
  • There are organisations who fall victim to wireless security break ins.
  • Anyone in a close enough distance to the organisation’s wireless internet connection might be able to eavesdrop on the wireless traffic.
  • This pentester who deals with wireless break-ins will assist in ensuring an organisation’s wifi and wireless protocols are safe from being exploited by a novice hacker who can take the opportunity to access private data and information.
• Lastly, the sixth type of penetration testing is “application penetration testing”.
  • This form of testing will focus on any weaknesses in an organisation’s applications, be it in their design, development or actual use of the application.
  • These pen-testers attempt to find any sort of mishaps in the application’s security protocol.
  • Since hacking techniques are evolving on a day-to-day basis, it is extremely imperative to test applications on a regular basis for new types of weaknesses. 

Black Box, Grey Box & White Box Penetration Testing:

Types of pentesting are often placed in 1 of the 3 different boxes, white box, black box or grey box and each of the different testing styles have distinct characteristics that separate each one of them.

White Box Penetration Testing:

• Firstly, we have “white box penetration testing”, this type of penetration testing is also referred to as crystal or oblique box pen testing.
  • It involves sharing full network and system information with the individual who is conducting the tests.
  • This type of penetration testing involves conducting a deep security audit of an organisation’s data and systems, and it is necessary to provide the person conducting the test with as much information as possible.
  • What this type of testing does is it assists in saving time and reducing the amount of money used.
  • This type of testing is extremely beneficial when it comes to imitating an attack on a specific system.
  • This type of penetration testing is more thorough than the other 2 as the individual conducting the test will have a great amount of access into areas where for example, a black box test cannot. For example into the quality of the code or even the application design.

There are a couple of advantages which are to be highlighted in terms of utilising this type of testing.

• Firstly, this type of testing ensures that all parts of the system are being exercised.
• Additionally, it discovers any sort of typographical errors and additionally does syntax checking.
  • This type of testing method does not take too much time, usually somewhere between two to three weeks to fully complete it.
• Lastly, this type of testing identifies design mistakes that might have happened as a result of the differences between the logical flow of the system and the execution of it.

However, it is imperative to highlight that white box testing does have its various types of disadvantages.

• For example, since the pen tester has a great amount of access into the organisation’s systems, it can take a long amount of time for him to determine which particular areas to focus on.
• Additionally, utilising the white box testing requires having tools that are expensive for the company to maintain as well as extremely advanced and sophisticated, for example code analyzers or debuggers. 

Black Box Penetration Testing:

• The second type of penetration testing that I will highlight is “black box penetration testing”.
  • In this test, the individual conducting the tests is given no information at all and no guidance. He goes into it completely blinded.
  • This type follows an approach of an attacker who is unprivileged, has no prior information to help him from the start of the access throughout the execution and potential exploitation.
  • This type of testing is regarded to be the most authentic type as it clearly shows what it would be like for someone who has no prior knowledge to hack into an organisation and potentially compromise them.
  • This option is by far the cheapest and most cost effective but might not be able to present the greatest results out of the three different types.

There are numerous advantages and disadvantages for using this type of testing method.

• Firstly, the advantages.
  • The hacker in this case does not need to be an expert in the field and in this type of testing there is no need to have knowledge on specific language knowledge.
  • Additionally, this type of test is often conducted from the perspective of the user and not the designer which is highly beneficial.
• However, along with these advantages there are a couple of disadvantages as follows:
  • These types of tests are challenging in terms of design.
  • In addition, this type of testing does not conduct everything within the system.
  • This is the longest type of penetration test and also lands up being the most costly.

During a black box test, one of the best and easiest ways for an ethical hacker to break into a system is by positioning and installing a series of exploits that he knows will work. This sort of testing method is often called the “trial and error” method. However, it is very important to note that this type of approach can only be done by a highly skilled and trained individual who properly understands the technical skills that will be involved during the process. This sort of testing cannot be done by just anyone and must be selected carefully and with great thought.

Grey Box Penetration Testing:

• The last type of penetration testing that I am going to highlight is “grey box penetration testing” which is also known as “translucent box text”.
  • In this type of testing, a limited amount of information is given and shared to the individual conducting the test.
  • The usual method that this is conducted in is login credentials.
  • This type of testing is extremely useful when it comes to grasping what the level of access could be for an individual who has some sort of information and how great the damage they can do or cause.
  • This type of testing is a fan favourite as it is in the middle of the other two, finding the greatest balance between them, between the most efficient and effective one and the most authentic one.

Some advantages that are present in this type of testing are as follows:

• The pen-tester does not have to be in need of access to the source of the code, it is a non-intrusive method and completely unbiased.
• In addition, there is a definite difference between who the developer is and who exactly the tester is, avoiding the risk of some sort of personal conflict.
• Lastly, in this type of testing there is no need to provide any sort of internal information regarding the organisation, the program functions or any other additional information about it.

It is imperative for a company or an organization to note which type of testing method might be most useful to them, considering their type of data, software and networks also realizing that the cheapest one or the quickest one might not be the best fit for them. They also need to take into account the amount of money they can afford on spending on the pen-tests and paying the pen-testers. Since it’s important for the longevity of the company to ensure their software’s and networks are safe, it is not advised to take the shortcut or try save money on the testing because in the long run it could lead them to way further setbacks and cost them much more money in the end. Safety over an organization’s data is extremely important in today’s world, with technology advancing on a daily basis and more and more individuals having the skills and knowledge on how to break into or a hack a system. It is something an organization needs to consider on a daily basis, also realizing the sophistication of the hacking methods and just because they were in the clear one day, it doesn’t necessarily mean they’re in the clear the next day. It is something that continuously needs to be checked and updated.