Penetration test: definition

In short

If a vulnerability assessment lists the doors that seem to be open, a penetration test tries to open them. It does not stop at the vulnerability: it exploits it, combines it with others and documents the path, for example "from a contact form on the website to the customer database". It is a largely manual, time-boxed activity that ends with a report.

How it works

First of all, the scope (which systems, which addresses, which applications), the rules of engagement (times, excluded techniques, emergency contacts) and the client's authorisation are set out in writing: without these, a test is not a test, it is unauthorised access.

Depending on how much information the tester receives, the test is called black box (none, like an external attacker), grey box (for example a standard user account) or white box (documentation and code). The typical stages are information gathering, service enumeration, exploitation, post-access activity (movement, privilege escalation) and a final report with the evidence and the fixes. The most widely used reference methodologies are the OWASP Web Security Testing Guide for web applications, NIST SP 800-115 and PTES.

Why it matters

A penetration test measures the combined effect of vulnerabilities, configuration errors and design choices that a scanner sees separately. It is useful before putting a critical application into production, after major changes to the infrastructure and when a customer or a standard asks for it: in the financial sector, for example, the DORA regulation requires some entities to carry out advanced threat-led penetration tests (TLPT).

It does have two limits, though: it is a snapshot of one moment and it covers only the agreed scope. It does not replace continuous checking, it complements it. The differences are explained in the guide vulnerability assessment and penetration test compared.

Example

A company that sells online commissions a grey box test of its customer portal. The tester, logged in with a test account, notices that the order number appears in the page address. By changing it, they can see other customers' orders, with name, address and phone number. No scanner had flagged it: technically, the page worked. The report documents the path and the fix (checking on the server side that the order belongs to the user), and the company avoids a data breach.

Related terms

• Vulnerability assessment
• Attack Surface Management
• MITRE ATT&CK: the catalogue of techniques that the most advanced tests draw on
• Residual risk