Penetration Testing | penetration testing methodology | Security Testing Methodology | [CEH V10]

 

Penetration Testing

---

In the Ethical Hacking environment, the most common term that often uses is "pentester." Pentesters are the penetration tester that has permission to hack a system by owner. Penetration testing is the process of hacking a system with the permission from the owner of that system, to evaluate security, Hack Value, Target of Evaluation (TOE), attacks, exploits, zero-day vulnerability & other components such as threats, vulnerabilities, and daisy chaining.
Figure 1-13 Comparing Pentesting.

Important for Penetration testing ?

If you want to be ready for an attack, you must be smart, to think like them, act like them. Hackers are skilled, having detailed information of hardware’s, software, networking and other related information. The need and importance of penetration testing, in the modern world where variously advanced threat such as Denial-of-service, Identity theft, theft of services, stealing information is common, system penetration ensure to counter the attack from malicious threat by anticipating methods. Some other major advantages and need for penetration testing is to uncover the vulnerabilities in systems and security deployments in the same way an attacker gains access: -

1. To identify the threats and vulnerabilities to organizations assets.
2. To provide a comprehensive assessment of policies, procedures, design, and architecture.
3. To set remediation actions to secure them before they are used by a hacker to breach security.
4. To identify what an attacker can access to steal.
5. To identify what information can be theft and its use.
6. To test and validate the security protection & identify the need for any additional protection layer.
7. Modification and up-gradation of currently deployment security architecture.
8. To reduce the expense of IT Security by enhancing Return on Security Investment (ROSI).

Types of Penetration Testing ?

Three types of Penetration testing are important to be differentiated because a penetration tester may have asked to perform any of them

1.Black Box

The black box is a type of penetration testing in which the pentester is blind testing or double-blind testing, i.e. provided with no prior knowledge of the system or any information of the target. Black boxing is designed to demonstrate an emulated situation as an attacker in countering an attack.

2.Gray box

Gray box, is a type of penetration testing in which the pentester has very limited prior knowledge of the system or any information of targets such as IP addresses, Operating system or network information in very limited. Gary boxing is designed to demonstrate an emulated situation as an insider might have this information and to counter an attack as the pentester has basic, limited information regarding target.

3.White box

The white box is a type of penetration testing in which the pentester has complete knowledge of system and information of the target. This type of penetration is done by internal security teams or security audits teams to perform auditing.

Phases of Penetration ?

Testing Penetration testing is a three-phase process.

1- Pre-Attack Phase

2- Attack Phase

3- Post-Attack Phase

Security Testing Methodology ?

There are some methodological approaches to be adopted for security or penetration testing. Industry-leading Penetration Testing Methodologies are:

1. Open Web Application Security Project (OWASP)
2. Open Source Security Testing Methodology Manual (OSSTMM)
3. Information Systems Security Assessment Framework (ISAF)
4. EC-Council Licensed Penetration Tester (LPT) Methodology

---