Penetration Testing Techniques

🛠️ Penetration Testing Techniques: An Overview

Penetration Testing (Pen Testing) is a simulated cyberattack on a system, network, or application to identify and exploit vulnerabilities before malicious actors can. It's a key component of proactive cybersecurity and helps validate the effectiveness of security controls.

---

🧠 Objectives of Penetration Testing

• Identify vulnerabilities before attackers do

• Test the effectiveness of security defenses

• Assess organizational response to real-world attacks

• Validate compliance with standards (e.g., PCI-DSS, HIPAA, ISO 27001)

• Improve incident response capabilities

---

🧩 Types of Penetration Testing

Type	Focus Area
External Testing	Public-facing assets like websites, DNS, firewalls
Internal Testing	Inside-the-network threats (e.g., insider threats)
Web Application Testing	Application logic, input validation, session management
Wireless Testing	Wi-Fi protocols, rogue access points
Social Engineering	Phishing, vishing, baiting
Physical Testing	Gaining physical access to facilities
Cloud Pen Testing	Misconfigurations and privilege issues in cloud environments

---

🔍 Penetration Testing Techniques

Here are the core techniques used during a penetration test:

---

🏗️ 1. Reconnaissance (Information Gathering)

• Passive Recon: OSINT (Open Source Intelligence), WHOIS, DNS records, social media, job listings

• Active Recon: Ping sweeps, port scans, banner grabbing

🛠 Tools:
Nmap, Recon-ng, theHarvester, Shodan

---

🔓 2. Scanning & Enumeration

• Network Scanning: Identify live hosts, open ports, services

• Enumeration: Extract usernames, shares, SNMP info, SMTP users

🛠 Tools:
Nmap, Netcat, Nessus, Nikto, Enum4linux

---

🧬 3. Vulnerability Analysis

• Identify known vulnerabilities in services, software, or configurations

🛠 Tools:
Nessus, OpenVAS, Qualys, Burp Suite, Nmap NSE scripts

---

💥 4. Exploitation

• Remote Code Execution

• SQL Injection

• Cross-Site Scripting (XSS)

• Buffer Overflow

• Privilege Escalation

🛠 Tools:
Metasploit, sqlmap, Burp Suite, Hydra, Cobalt Strike

---

🐍 5. Post-Exploitation

• Explore access gained

• Dump credentials (e.g., mimikatz)

• Lateral movement (pivoting)

• Establish persistence (e.g., backdoors)

🛠 Tools:
PowerShell Empire, Metasploit, CrackMapExec, BloodHound

---

📤 6. Reporting & Remediation

• Document findings, including:

  • Vulnerability exploited

  • Risk level

  • Proof of concept (PoC)

  • Recommendations for mitigation

• Provide both technical and executive summaries

---

🎯 Common Attack Vectors Tested

Vector	Techniques Used
Web Applications	SQLi, XSS, CSRF, file inclusion, RCE
Authentication Systems	Brute force, credential stuffing, 2FA bypass
Wireless Networks	WPA2 cracking, rogue APs, evil twin attacks
APIs	Input fuzzing, broken auth, data exposure
Cloud Infrastructure	Privilege escalation, S3 misconfig, SSRF
Active Directory	Kerberoasting, Pass-the-Hash, DCsync

---

🛡️ Ethical Considerations

• Get proper authorization (signed agreement or Rules of Engagement)

• Minimize risk to live systems

• Respect data privacy and client scope

• Follow responsible disclosure practices

---

📘 Certifications & Standards

• Certifications: OSCP, CEH, GPEN, PNPT

• Frameworks:

  • OWASP Top 10 (for web apps)

  • MITRE ATT&CK

  • PTES (Penetration Testing Execution Standard)

  • NIST SP 800-115 (Technical Guide to Information Security Testing)

---

🧾 Summary Table

Phase	Goal	Example Tools
Recon	Gather intel	Nmap, theHarvester
Scanning	Map attack surface	Nessus, Nikto
Exploitation	Gain unauthorized access	Metasploit, sqlmap
Post-Exploitation	Maintain access, pivot	Mimikatz, Empire
Reporting	Share findings and fixes	Dradis, Serpico