All you want to know about Penetration Testing

A penetration test, conjointly called a pen test, may be a simulated cyber-attack against your automatic data processing system to envision for exploitable vulnerabilities. within the context of internet application security, penetration testing is often accustomed augment an internet application firewall.

Pen testing will involve the tried breaching of any variety of application systems, to uncover vulnerabilities, like unsensitized inputs that are at risk of code injection attacks.

Penetration testing stages

The pen testing method will be classified into 5 stages.

1. Planning :

Defining the scope and goals of a check, together with the systems to be self-addressed and also the testing ways to be used.
intelligence Gathering to raised perceive how a target works and its potential vulnerabilities.

2. Scanning :

The next step is to grasp how the target application can reply to numerous intrusions tries. this is generally done by using:
Static analysis
Dynamic analysis.

3. Gaining Access :

This stage uses internet application attacks, like cross-site scripting, SQL injection and backdoors, to uncover a targets vulnerabilities. Testers then attempt to exploit these vulnerabilities, generally by escalating privileges, stealing information, intercepting traffic, etc., to grasp the injury they'll cause.

4. Maintaining access :

The goal of this stage is to examine if the vulnerability will be accustomed to target a persistent presence within the exploited system long enough for a foul actor to realize in-depth access. the thought is to imitate advanced persistent threats, which regularly remain there in the system for months so as to steal an organizations most sensitive information.

5. Analysis :

The results of the penetration check are then compiled into a report detailing:
Specific vulnerabilities that were exploited
Sensitive information that was accessed

Methods of Penetration testing :

External testing
Internal testing
Blind testing
Double-blind testing
Targeted testing
Penetration testing and internet application firewalls

For many forms of pen testing (with the exception of blind and run tests), the tester is probably going to use WAF information, like logs, to find and exploit an applications weak spots.

pen testing satisfies a number of the compliance necessities for security auditing procedures, together with PCI DSS and SOC a pair of. Few standards, like PCI-DSS, will be satisfied through the utilization of an authorized WAF. Doing so, however, doesnt create pen testing any less helpful because of its same edges and talent to enhance on WAF configurations.