Penetration Testing

Penetration Testing

Overview

Penetration testing is the authorized practice of simulating attacks against a system to discover exploitable vulnerabilities before malicious actors do. Unlike automated security scanning (SAST/DAST), pen testing involves human expertise to chain vulnerabilities, test business logic flaws, and assess real-world exploitability. Pen tests are conducted under a clear scope and rules of engagement, and results are reported with severity ratings and remediation guidance.

Important: Penetration testing must always be performed with explicit written authorization. Unauthorized testing is illegal in virtually every jurisdiction. Ensure you have a signed rules of engagement document before beginning any testing.

Key References

Methodologies

Pen Test Types

Testing Approaches

Pen Testing Tools

Reconnaissance and Enumeration

Web Application Testing

Network and Infrastructure

Post-Exploitation

Mobile

Cloud

Scoping and Rules of Engagement

Every pen test must begin with a formal scoping and rules of engagement agreement:

Severity Rating

Reporting

A pen test report should include:

1. Executive Summary — non-technical overview of findings, risk level, and key recommendations for leadership
2. Scope and Methodology — what was tested, how, and testing approach (black/gray/white box)
3. Findings — each vulnerability with: title, severity (CVSS), description, affected asset, evidence (screenshots, request/response), business impact, remediation steps
4. Risk Summary — findings grouped by severity with counts
5. Remediation Roadmap — prioritized list of fixes with effort estimates
6. Appendices — tool output, raw scan results, methodology details

Bug Bounty and Responsible Disclosure

Responsible Disclosure Process

1. Researcher discovers vulnerability
2. Researcher reports via designated channel
3. Company acknowledges receipt (target: 1 business day)
4. Company triages and validates (target: 5 business days)
5. Company remediates (target: 90 days for standard, 7 days for actively exploited)
6. Coordinated public disclosure after fix

Best Practices

• Always obtain written authorization before testing — unauthorized pen testing is a criminal offense regardless of intent.
• Scope tightly — clearly define what is in and out of scope to protect both the tester and the organization.
• Use gray-box testing as the default for most engagements — it provides the best balance of realism and coverage.
• Report findings with business impact, not just technical severity — help stakeholders understand the real-world risk.
• Verify remediations with a retest engagement after fixes are deployed — do not assume fixes are complete.
• Maintain a vulnerability disclosure policy (VDP) even if you do not run a bug bounty — it gives researchers a safe way to report issues.
• Separate pen testing from automated scanning — automated tools find known patterns; human testers find business logic flaws and chained exploits.
• Conduct pen tests at least annually and after major releases or architecture changes.
• Treat pen test reports as confidential — they contain detailed exploitation instructions for your systems.
• Rotate pen testing firms periodically to get fresh perspectives and avoid blind spots from familiarity.