Penetration Testing Stages
1. Planning and reconnaissance
The first stage involves:
- Defining a test’s scope and objectives, as well as the systems to be tested and the testing methodologies to be employed.
- To better understand how a target operates and its possible weaknesses, gather intelligence (e.g., network and domain names, mail server).
2. Scanning
The next stage is to figure out how the target application will react to different types of intrusion attempts. This is usually accomplished by using the following methods:
- Static analysis – Examining an application’s code to predict how it will behave when it is executed. In a single pass, these tools can scan the whole code.
- Dynamic analysis is the process of inspecting an application’s code while it is operating. This method of scanning is more practical since it gives a real-time picture of an application’s performance.
3. Gaining Access
This stage employs web application assaults such as cross-site scripting, SQL injection, and backdoors to identify weaknesses in a target. To understand the harm that these vulnerabilities might do, testers attempt to exploit them, often by escalating privileges, stealing data, intercepting communications, and so on.
4. Maintaining access
The purpose of this step is to determine if the vulnerability can be exploited to maintain a persistent presence in the compromised system long enough for a bad actor to get in-depth access. The goal is to mimic sophisticated, persistent attacks, which may stay in a system for months and steal an organization’s most sensitive data.
5. Analysis
The penetration test findings are then collected into a report that includes:
- Particular flaws that were exploited
- Access to sensitive information
- The amount of time the pen tester was able to stay unnoticed in the system.
Security experts use this data to assist tune an enterprise’s WAF settings and other application security solutions in order to fix holes and guard against future assaults.
Penetration Testing Methods
- External testing – External penetration tests target a firm’s internet-visible assets, such as the web application itself, the corporate website, and email and domain name servers (DNS). The objective is to obtain access and extract useful information.
- Internal testing – In an internal test, a tester having access to an application behind the company’s firewall mimics a hostile insider attack. This is not always emulating a renegade employee, and a frequent starting point is an employee whose credentials were obtained as a result of a phishing attempt.
- Blind testing – In a blind test, a tester is merely provided with the name of the targeted organization. This provides security workers with a real-time view of how an actual application attack might occur.
- Double-blind testing – Security workers in a double-blind test have no previous information of the simulated assault. They won’t have time to shore up their fortifications before an attempted breach, much as in the real world.
- Targeted testing – In this scenario, the tester and the security officers collaborate and keep each other informed of their movements. This excellent training exercise offers a security team real-time feedback from a hacker’s perspective.
Penetration Testing and Web Application Firewalls
Penetration testing and WAFs are mutually incompatible security methods.
With the exception of blind and double-blind tests, the tester is likely to leverage WAF data, such as logs, to find and exploit an application’s weak areas during various types of pen-testing.
WAF administrators may then profit from pen-testing data. After completing a test, WAF settings may be modified to safeguard against the flaws detected during the test.
Finally, pen-testing meets some of the criteria for security auditing processes, such as PCI DSS and SOC 2. Certain requirements, such as PCI-DSS 6.6, may only be met by using a certified WAF. However, because of the advantages above and the flexibility to modify WAF settings, doing so does not make pen testing any less helpful.
< Previous | Home | Next >
