EDX Security Hub • Penetration Testing Guide

What is Penetration Testing?

Penetration testing (pen testing) is a simulated cyberattack against computer systems, networks, applications, or APIs to identify security vulnerabilities that could be exploited by attackers. Pen testers (ethical hackers) use the same tools and techniques as malicious actors but operate with explicit authorization. Pen testing helps organizations discover weaknesses before attackers do, prioritize remediation, and comply with regulatory requirements (PCI DSS, HIPAA, SOC2, ISO 27001).

Market Size: Global penetration testing market size: $2.5 billion (2024). 85% of organizations conduct external pen tests annually. 70% conduct internal network pen tests. Average cost of pen test: $10,000-$50,000 (external), $20,000-$100,000 (internal).

$2.5B

Global Market (2024)

85%

Annual External Pen Tests

$10-100K

Average Test Cost

Common penetration testing types:

External network penetration testing (internet-facing assets)
Internal network penetration testing (corporate LAN, Active Directory)
Web application penetration testing (OWASP Top 10, APIs)
Mobile application penetration testing (iOS, Android)
Cloud penetration testing (AWS, Azure, GCP)
Social engineering (phishing, vishing, physical penetration)
Wireless penetration testing (Wi-Fi, Bluetooth, RFID)
IoT penetration testing (embedded devices, firmware)

Penetration Testing Phases (PTES Framework)

Phase 1: Reconnaissance (OSINT)

Passive information gathering: DNS enumeration (dig, nslookup), WHOIS, Google dorks, Shodan, social media OSINT, data breaches (HaveIBeenPwned). No direct interaction with target.

Phase 2: Scanning & Enumeration

Active scanning: Nmap port scans, service version detection, vulnerability scanning (Nessus, OpenVAS), directory brute-forcing (gobuster, dirb), subdomain enumeration.

Phase 3: Exploitation (Gaining Access)

Exploit vulnerabilities (Metasploit, manual exploitation). Gain initial foothold (reverse shell, web shell). Examples: SQL injection, XSS, RCE, buffer overflow, credential reuse.

Phase 4: Post-Exploitation

Privilege escalation (user → root/administrator), lateral movement (pivoting), persistence (backdoors, scheduled tasks), data exfiltration (sensitive data).

Phase 5: Reporting

Document findings: vulnerabilities, risk ratings (CVSS), exploitation steps, impact, remediation recommendations, evidence (screenshots, logs). Deliver executive summary and technical report.

Types of Penetration Testing (By Knowledge Level)

Black Box (Zero Knowledge)

Tester has no prior knowledge of target (only domain name/IP range). Simulates external attacker. Most realistic but time-consuming. Requires extensive reconnaissance.

Realistic

Gray Box (Partial Knowledge)

Tester has some internal knowledge (credentials, architecture diagrams, API documentation). Simulates insider threat or compromised user. Most common.

White Box (Full Knowledge)

Tester has complete access: source code, credentials, network diagrams, configuration files. Most thorough, efficient. Used for compliance (PCI DSS).

Essential Penetration Testing Tools

Nmap (Network Mapper)

Network discovery and port scanning. SYN scan (-sS), service version detection (-sV), OS detection (-O), script engine (NSE). nmap -sS -sV -p- -T4 target.com

Metasploit Framework (MSF)

Exploit development and execution. Payloads (Meterpreter), post-exploitation modules, auxiliary scanners. msfconsole, search , use exploit/multi/handler.

Burp Suite (Web App Testing)

Web proxy for intercepting/modifying HTTP/HTTPS traffic. Scanner, Intruder (fuzzing), Repeater (manual testing), Collaborator (out-of-band detection).

Nessus / OpenVAS (Vulnerability Scanner)

Automated vulnerability scanning. Nessus Professional ($3,990/year). OpenVAS (free, open-source). Detect CVEs, misconfigurations, missing patches.

Wireshark / TShark

Network protocol analyzer. Capture live traffic, analyze PCAP files, filter protocols, follow TCP streams, detect anomalies.

Gobuster / Dirb (Directory Brute-Forcing)

Discover hidden directories, files, and subdomains. Wordlist-based brute force. gobuster dir -u https://target.com -w /usr/share/wordlists/dirb/common.txt

Hydra (Password Brute-Forcing)

Online password cracking. Supports SSH, FTP, HTTP, RDP, SMTP, MySQL, PostgreSQL. hydra -l admin -P passwords.txt ssh://192.168.1.100

SQLmap (SQL Injection)

Automated SQL injection detection and exploitation. Database fingerprinting, data extraction, command execution. sqlmap -u "http://target.com?id=1" --dbs

Penetration Testing Methodology Example

            // External network penetration testing example

# Phase 1: Reconnaissance (Passive)
whois target.com
dig +short target.com
theHarvester -d target.com -b google

# Phase 2: Scanning (Active)
nmap -sS -sV -O -p- -T4 target.com
nmap -sU -p 53,161,500,4500 target.com

# Phase 3: Vulnerability Scanning
nmap --script vuln target.com
nikto -h https://target.com

# Phase 4: Exploitation (Web Application)
gobuster dir -u https://target.com -w /usr/share/wordlists/dirb/common.txt
sqlmap -u "https://target.com/page?id=1" --dbs

# Phase 5: Post-Exploitation (if successful)
# (with authorization only)
python3 -c 'import pty; pty.spawn("/bin/bash")'  # Upgrade shell
sudo -l  # Check sudo permissions
find / -perm -4000 2>/dev/null  # SUID binaries

# Phase 6: Cleanup & Reporting
# Remove backdoors, clear logs, restore configurations
# Document findings, CVSS scores, remediation steps
        

Interactive Port Scan Simulation (Nmap)

This demonstration simulates an Nmap TCP SYN scan on a target IP address:

Enter an IP address to simulate Nmap port scan

This is a simulated demonstration. Real penetration testing requires written authorization. Unauthorized scanning violates CFAA (US) and Computer Misuse Act (UK).

Penetration Testing Report Structure

            // Penetration testing report (standard template)

1. Executive Summary
   - Testing objectives, scope, timeline
   - Overall risk rating (Critical, High, Medium, Low)
   - Key findings summary (top 5 vulnerabilities)
   - Remediation roadmap

2. Technical Report
   - Methodology (PTES, OWASP, NIST)
   - Scope (IP ranges, domains, applications)
   - Tools used (Nmap, Metasploit, Burp Suite, Nessus)

3. Findings
   - Vulnerability ID (VULN-001)
   - Title: SQL Injection in login parameter
   - CVSS Score: 8.3 (High)
   - Affected Asset: https://target.com/login
   - Description: Time-based blind SQL injection
   - Impact: Database compromise, data theft
   - Proof of Concept (PoC): ' AND SLEEP(5) --
   - Remediation: Parameterized queries (PreparedStatement)
   - References: CWE-89, OWASP A03:2021

4. Appendix
   - Scan logs (Nmap, Nessus)
   - Screenshots (exploitation evidence)
   - Remediation timeline
   - Pentester qualifications (OSCP, GPEN, GWAPT)
        

Legal & Authorization Requirements

Penetration testing is illegal without explicit written authorization. Unauthorized scanning violates CFAA (US), Computer Misuse Act 1990 (UK), and similar laws worldwide.

CFAA (US): Unauthorized scanning (port scan, vulnerability scan) - Federal felony, up to 10-20 years imprisonment, fines up to $250,000.
Computer Misuse Act 1990 (UK): Unauthorized access to computer material - Up to 2-10 years imprisonment, unlimited fines.
Written Authorization Required: Signed penetration testing contract (SOW - Statement of Work). Define scope, rules of engagement, testing windows, emergency contacts.
PCI DSS Requirement 11.3: Annual external and internal penetration testing for compliance.
ISO 27001: Penetration testing required for certification (control A.12.6.1).
HIPAA (US): Penetration testing required for healthcare organizations (45 CFR § 164.308(a)(1)(ii)(B)).

Legal Disclaimer & Compliance Notice

Penetration testing must be conducted with explicit written authorization from the target organization. Unauthorized testing (including port scanning, vulnerability scanning, exploitation) violates:

Computer Fraud and Abuse Act (CFAA) - US (up to 20 years imprisonment)
Computer Misuse Act 1990 - UK (up to 10 years imprisonment)
EU Cybercrime Directive (2-10 years imprisonment)
State computer crime laws (California, Texas, New York, etc.)

Important: This guide is for educational and defensive purposes only. Always obtain written authorization before conducting penetration testing. Use dedicated testing environments (labs, CTF platforms) for practice (HackTheBox, TryHackMe, PentesterLab).

Penetration Testing Certifications

OSCP (Offensive Security Certified Professional)

Industry-standard penetration testing certification. 24-hour practical exam (buffer overflow, web, privilege escalation). Requires Offensive Security course (PEN-200).

GPEN (GIAC Penetration Tester)

SANS SEC560 certification. Multiple choice + practical exam (CyberLive). Covers scanning, exploitation, post-exploitation, reporting.

CEH (Certified Ethical Hacker)

EC-Council certification. 125 multiple choice questions. Covers footprinting, scanning, enumeration, system hacking, web hacking.

PNPT (Practical Network Penetration Tester)

TCM Security certification. 5-day practical exam (OSINT, external, internal, Active Directory). More affordable than OSCP.

Further Resources

PTES (Penetration Testing Execution Standard)

Industry framework for penetration testing methodology (pre-engagement, reconnaissance, scanning, exploitation, post-exploitation, reporting).

OWASP Testing Guide (v4/v5)

Web application penetration testing methodology (93 test cases). Covers OWASP Top 10.

HackTheBox (HTB) & TryHackMe

Legal penetration testing practice platforms. Realistic vulnerable machines (Windows, Linux, Active Directory).