Penetration Testing

Penetration Testing  Overview

A penetration test, also known as a pen test or ethical hacking is a simulated and authorized cyber-attack against an Organization. It is mostly conducted by the Organization itself . Its purpose is to test the Organization’s  cyber defense , check for exploitable vulnerabilities and evaluate the overall web security of information systems.

There are different types of penetration testing which are mentioned below.

Whitebox Testing

Full information about the target is shared with the pen testers. This type of testing confirms the effectiveness of internal vulnerability assessment and management controls .In such testing , known software vulnerabilities and common misconfigurations in an organization’s information systems are discovered and exploited by the pen-tester. In such testing , information about the IP address, System credentials and web application credentials related to the scope of the activity are shared with the pen-tester.  In some business critical organizations ,they do not test on Production environment and instead test on a replica of the production environment .

Blackbox Testing

No information is shared with the testers about the internal systems of the target. This type of testing is performed from an external perspective and is aimed at identifying ways to access an organization’s internal IT assets. This more accurately models the risk faced from attackers that are unknown or unaffiliated to the target organization. However, the lack of information can also result in vulnerabilities remaining undiscovered in the time allocated for testing. In such testing , the pen-tester is only informed with the organization name .

Grey box Testing

As the name suggests it is the combination of Black and White box testing techniques. Grey Box is a technique to conduct the penetration testing with partial knowledge of the scope. The purpose of this testing is to stimulate an attacker which could be a malicious insider . The attacker has limited user level access and the objective is to see if an attacker can escalate privileges to admin level and how deep an attacker can penetrate in the network. In such testing ,List of IP address and URLs of the organization are shared with pen-tester.

For more details , you can refer to this article .