A test that where a tester attempts to access the system of a target, and is allowed to do so by contract between tester and target.
It is an in-depth targeted investigation performed by actively attempting to exploit discovered or potential vulnerabilities by skilled security individuals.
This stands in contrast to Vulnerability Assessment which is performed by using automated scanning tools to locate holes in security by using only known vulnerabilities (e.g. CVEs).
Process
A pentest is often performed with the process of the following phases from top to bottom.
They are not always followed linearly as shown in the diagram below.
1. Pre-engagement phase
Communicate with client to find scope, objective, establish timelines.
This ends with a Rule of Engagement (RoE) document, that outlines the permitted testing activities and emergency procedures.
An Non-disclosure Agreement (NDA) is usually also signed, to ensure that the client can trust the pentesters in not disclosing private information.
It is also usual obtain contact information. This is to ensure private communication and the possibility of reaching emergency contacts in case anything should go wrong.
2. Information gathering phase
Information is gathered through various reconnaissance techniques divided into:
Passive recon: OSINTActive recon: gathering information by directly interacting with the target system, e.g. Nmap port scanning, Web Enumeration.
3. Vulnerability assessment phase
Analyse the information gathered from the previous phase to identify potential weaknesses.
4. Exploitation phase
Actively exploit the vulnerabilities identified in the previous phase and asses impact.
5. Post-exploitation phase
Once an exploit is performed and an initial access is gained in the previous phase, this phase performs privilege escalation, data exporting, and maintaining persistence.
6. Lateral movement
Navigate through the network to identify additional systems to gain access to, perhaps utilising trust relationships with the already exploited system.
7. Proof of concept
Create a detailed documentation and evidence that demonstrates how vulnerabilities were exploited, to help the client’s technical team to fix the the vulnerabilities.
8. Post-engagement phase
Writing a comprehensive report for the client that includes:
- executive summary for management
- detailed finding for the technical team
- clear recommendation for remediation
Each vulnerability should be described with its potential impact with risk ratings, steps to reproduce, and specific recommendation to fix it.
It should include evidence such as screenshots and logs to support the findings.
9. Remediation support and retesting
After delivering report it is common to include a period of remediation, where the client can ask questions about the findings and how to implement fixes.
This is sometimes followed by a retest, to verify that the fixes were implemented correctly and no new vulnerabilities were introduced during the remediation.