99 Wall Street Suite 1808, New York, NY 10005
[email protected]
Join Now

Penetration testing

Penetration testing

The purpose of penetration testing

Penetration testing can be both automated and manual. Despite its method, penetration testing includes several steps such as:

  • Reconnaissance: collecting pieces of information regarding the target before the test begins;
  • The identification of the exploitable entry points;
  • The actual or virtual attempt to break in;
  • The final report that includes the results of the test that has been run.

Starting from this, we can state that the main goal of a pen test is to clearly identify security weak spots. Other than that, it is possible to list other specific objectives of penetration testing:

  • Test the compliance of the security policy;
  • Test the awareness of the staff regarding security matters;
  • Check if and how an organization can face security disasters.

Different kinds of penetration testing

As far as penetration testing is concerned, there are several ways it can be performed. In the following list, we can go through these methods:

  • External Testing: this test has a specific objective: identifying whether an attacker can get in and how deep can the attacker go once he’s in. Which are the targets of such tests? Anything visible on the internet:
    • DNS (Domain Name Servers),
    • Website,
    • Web applications,…
  • Internal testing: an internal test is a simulation of an attack performed by an insider. If an attacker manages to steal an employee’s credentials, he already is behind the firewall and this specific test considers this scenario.
  • Targeted testing: this specific test is run from the pentester and the IT staff of the company. These two entities work side by side and this is helpful to the IT staff that can better understand the attacker’s perspective.
  • Blind testing: this could be a quite expensive testing methodology. The tester usually has only the company name available as information, anything else is often not provided. This test shows how an actual attack takes place.
  • Double Blind testing: this test assumes that the IT staff has no knowledge at all about the upcoming attack. This test fakes a could-be-situation where the IT staff has no time to realize what’s going on.