A Sneak Peek into Penetration Testing

A pen test, i.e., penetration testing, is basically how you would try to get access to a particular system while being authorised to do so. Usually, companies hire people to test their applications so as to prevent actual hackers from gaining access to their products. "Prevention is better than cure" sounds very suitable for this process as penetration testing embodies exactly this.

Basically, a pen test is a simulated cyberattack. The important point to be noted here is authorization. Every penetration test is performed with explicit permission from the system owner/company.

A penetration test typically follows a structured methodology. While different organizations may use slightly different frameworks, the overall process remains similar; from gathering information about the target to documenting the findings in a detailed report.

There are multiple stages in a penetration test and I'll briefly explain them.

Stage 1. Reconnaissance /rɪˈkɒnɪs(ə)n(t)s/

Reconnaissance means the act of scouting, surveying, or exploring an area to gather information. It is commonly used to find out about enemy positions, land features, or general conditions before taking action. Short terms for it include recon or recce.

In simple terms, it's basically gathering all the information you can without actively being in direct contact with the system. Imagine walking into a library and looking at the shelves. You notice the genres, authors, and book titles, but you don't actually read them. You're simply gathering information. Reconnaissance works in much the same way.

Scope: Defines the boundaries and objectives of the testing process. It identifies which systems, applications, or networks will be tested and outlines rules and permissions.

Information Gathering: Collects details about the target system, such as IP addresses, technologies, endpoints, and configurations.

It's like saying you're going to study mathematics today. You haven't started studying yet, but you've defined the plan of action for today: it's maths. Likewise, you define the scope of testing. You can test functionalities, or you can test an entire application. But here we're only defining what we're going to test. Then you gather all the required materials you need for your study session, like your books, notes, etc.

Now that we've gathered enough information, it is time to actively interact with our target. This is where scanning begins.

Stage 2: Scanning This is the first actual hands-on activity we do. Here, after gathering information, the attacker or tester actively examines systems for open services and weaknesses. Our goal is to identify attack surfaces and vulnerabilities. What we do here is:

1. Port Scanning: We identify the open/closed/filtered ports on a target system and determine which network service is accessible.
2. Service Scanning: Here we actually detect which service is running on open ports using a few commands.
3. Version detection: Here we identify which software and version running on the detected service.
4. Vulnerability Scanning: We search for the known security weaknesses, like outdated software, missing patches, or misconfigurations.
5. Enumeration: We gather information from the discovered services like usernames, shares, hostnames, domain information and much more.

Stage 3: Gaining Access So, naturally, when we finish hunting down information about our target system, we need to check which vulnerabilities can be exploited. Of course, we should be authorized to do so. We can do this easily if the system is vulnerable to:

1. Password attacks: attempting to obtain valid credentials using techniques like brute force, dictionary attacks and more.
2. Software exploitation: exploiting vulnerabilities like buffer overflows, remote code execution, and privilege escalation to gain unauthorized access.
3. Web application attacks: Targets web applications through SQL Injection (SQLi), Cross-Site Scripting (XSS), command injection, file inclusion, and authentication bypass.
4. Wireless attacks: by exploiting weaknesses in wireless networks like weak Wi-Fi passwords, rogue access points and evil twin attacks, etc., which I shall explain in detail in my upcoming articles.

Stage 4: Maintaining Access Once access has been obtained, the next objective is to maintain that access. If we think like a hacker, the goal is to maintain access so we can exploit more and gain more information and control over the systems. This can be done by many methods like:

1. Backdoors: hidden methods of regaining access without repeating the original exploit.
2. Persistence mechanisms: ensuring access even after system reboot.
3. Privilege escalation: accessing a role that you're not allowed to, and more.

Stage 5: Covering Tracks Actual hackers remove all evidence of their activities. This is done by log manipulation (clearing all the logs and entries), hiding malicious files, timestamp modification, clearing command histories and traffic obfuscation (concealing network activity using proxy servers).

However, ethical hackers usually discuss or demonstrate these techniques to help organizations understand how attackers evade detection, rather than actually removing evidence.

Stage 6: Documentation The final phase is writing a report. Documenting all findings in a structured report, including vulnerabilities, severity levels, proof of concept, and recommended fixes. This report evaluates the impact of successful exploitation, including what data or systems were accessed and how severe the risk is.

Conclusion: Penetration testing isn't about breaking systems; it's about understanding how they can be broken before someone with malicious intent does. By thinking like an attacker while acting responsibly, ethical hackers help organizations uncover weaknesses before they turn into costly security breaches.

This article introduced the six major stages of a penetration test, from reconnaissance to documentation. Remember, penetration testing should only ever be performed on systems for which you have explicit permission. Testing systems without authorization is illegal and unethical.

Thank you for reading! If you're just beginning your cybersecurity journey, I hope this article gave you a clearer picture of how penetration testing works. In upcoming articles, we'll dive deeper into port scanning and see how ethical hackers begin interacting with a target system.

Until then, stay curious and keep learning!