Pre-Engagement
The pre-engagement stage is where the main commitments, tasks, scope, limitations, and related agreements are documented in writing.
You can think the before the pentesting process with the client.
Penetration Testing Overview
A Penetration Test (Pentest) is an organized, targeted, and authorized attack attempt to test IT infrastructure and its defenders to determine their susceptibility to IT security vulnerabilities. A pentest uses methods and techniques that real attackers use.
Vulnerability Assessments
Vulnerability analysis is a generic term that can include vulnerability or security assessments and penetration tests. In contrast to a penetration test, vulnerability or security assessments are performed using purely automated tools. Systems are checked against known issues and security vulnerabilities by running scanning tools like Nessus, Qualys, OpenVAS, and similar. In most cases, these automated checks cannot adapt the attacks to the configurations of the target system. This is why manual testing conducted by an experienced human tester is essential.
Testing Methods
External Penetration Test
Many pentests are performed from an external perspective or as an anonymous user on the Internet.
Internal Penetration Test
In contrast to an external pentest, an internal pentest is when we perform testing from within the corporate network. So commonly, like active directory pentesting process is in the internal penetration test.
Types of Penetration Testing
| Blackbox | Minimal. Only the essential information, such as IP addresses and domains, is provided. You dont know anything. |
| Greybox | Extended. In this case, we are provided with additional information, such as specific URLs, hostnames, subnets, and similar. |
| Whitebox | Maximum. Here everything is disclosed to us. This gives us an internal view of the entire structure, which allows us to prepare an attack using internal information. We may be given detailed configurations, admin credentials, web application source code, etc. |
| Red-Teaming | May include physical testing and social engineering, among other things. Can be combined with any of the above types. |
| Purple-Teaming | It can be combined with any of the above types. However, it focuses on working closely with the defenders. |