Types of penetration testing

As an aspiring ethical hacker and penetration tester, it’s important to understand the difference between a vulnerability assessment and penetration testing. In a vulnerability assessment, the cybersecurity professional uses a vulnerability scanner to perform authenticated and unauthenticated scans, which is used to help identify the security posture of the targeted systems within the organization. These vulnerability scanners use various techniques to automate the process of discovering a wide range of security weaknesses in systems.

The downside of using an automated vulnerability scanning tool is its incapability to identify the issues that manual testing can via penetration testing to validate the vulnerabilities that actually exist on the target, and this is one of the many reasons why organizations hire penetration testers to perform these assessments on their systems. However, if the penetration tester only delivers the reports of the vulnerability scanning tools instead of performing manual testing during a network-based penetration test, in my opinion, this is highly unethical. Keep in mind that most effective security assessments often involve a combination of automated scanning and manual penetration testing. Automated tools can quickly cover a broad surface area, allowing manual testers to focus their efforts on more complex and potentially high-impact vulnerabilities. During the course of this book, you will learn how to perform successful penetration testing using industry practices, tools, and techniques.

In the upcoming subsections, you will learn about common types of penetration testing and their use cases.

Web application penetration testing

Web application penetration testing (WAPT), is the most common form of penetration testing and is likely to be the first penetration testing job most people reading this book will be involved in. WAPT is the act of performing manual identification and exploitation of security vulnerabilities in a targeted web application using techniques such as SQL injection (SQLi), cross-site scripting (XSS), and business logic errors that automated tools might miss.

In the later chapters of this book, you will gain the skills and hands-on experience of getting started with WAPT.

Mobile application penetration testing

As you may have noticed, the different types of penetration testing each have specific objectives. Mobile application penetration testing is similar to WAPT but it’s specific to mobile applications, which contain their own attack vectors and threats. This is a rising form of penetration testing with a great deal of opportunity for those who are looking to break into this field and have an understanding of mobile application development.

Social engineering penetration testing

Social engineering is the art of manipulating basic human psychology (the mind) to find human-based vulnerabilities and trick potential victims into doing things they may not otherwise do. The primary goal of social engineering penetration testing is to identify vulnerabilities in an organization’s security awareness and procedures and to measure how employees respond to social engineering attacks.

For instance, adversaries will attempt to trick an employee within a targeted organization into connecting a malware-infected USB drive to their computer or opening a malware-infected attachment within an email message. In my opinion, it is the most adrenaline-filled type of security assessment.

In this form of penetration testing, you may be asked to do activities such as sending phishing emails, making vishing phone calls, or talking your way into secure facilities and connecting a USB drive to the system to determine what a real adversary could achieve. There are many types of social engineering attacks, which will be covered later on in this book.

Network penetration testing (external and internal)

Network penetration testing focuses on identifying security weaknesses in a targeted environment. The penetration test objectives are to identify the flaws in the targeted organization’s systems, their networks (wired and wireless), and their networking devices such as switches and routers.

The following are some tasks that are performed using network penetration testing:

• Bypassing an intrusion detection system (IDS)/IPS
• Bypassing firewall appliances
• Password cracking
• Gaining access to end devices and servers
• Exploiting misconfigurations on switches and routers

External network penetration testing focuses on performing security testing from the internet to identify any security vulnerabilities that a malicious actor can identify and exploit to gain authorized access to the organization’s internal network. In internal penetration testing, the penetration tester deploys their attack machine, which is directly connected to the organization’s internal network; therefore, the penetration testing is no longer concerned about bypassing the organization’s perimeter firewall.

Cloud penetration testing

Cloud penetration testing involves performing security assessments to identify the risks on cloud-based platforms to discover any security vulnerabilities that may expose confidential information to malicious actors. Before attempting to directly engage a cloud platform, ensure you have legal permission from the cloud provider. For instance, if you are going to perform penetration testing on the Microsoft Azure platform, you’ll need legal permission from both the cloud provider (Microsoft), as your actions may affect other users and services who are sharing the data center, and the customer who is hiring you for the service.

Cloud penetration testing can include various aspects such as testing the cloud provider’s infrastructure, the customer’s cloud-based applications, and the configuration of cloud services such as Software as a Service (SaaS), Platform as a Service (PaaS), and Infrastructure as a Service (IaaS).

Physical penetration testing

Physical penetration testing focuses on testing the physical security access control systems in place to protect an organization’s data. Security controls exist within offices and data centers to prevent unauthorized persons from entering secure areas of a company.

Physical security controls include the following:

• Security cameras and sensors – Security cameras are used to monitor physical actions within an area.
• Biometric authentication systems – Biometrics are used to ensure that only authorized people are granted access to an area.
• Doors and locks – Locking systems are used to prevent unauthorized persons from entering a secure room or area.
• Security guards – Security guards are people who are assigned to protect something, someone, or an area.

Having completed this section, you are now able to describe various types of penetration testing. Your journey ahead won’t be complete without understanding the phases of hacking. The different phases of hacking will be covered in the next section.