A penetration test, also sometimes referred to as a pen test or a vulnerability assessment, is the term given to a simulated cyber-attack on a computer system that is intended to test out potential vulnerabilities that could be exploited by hackers.
Penetration testing is often used for the purpose of augmenting web application firewalls regarding web application security and website security.
Penetration testing often involves trying to breach a variety of different application systems such as frontend or backend servers and application protocol interfaces to find such vulnerabilities, including the likes of unsanitized inputs which could be vulnerable to code injection attacks.
WAF security policies can then be finetuned by the insights that the penetration test is able to provide, as can patch issues found during vulnerability testing.
The Different Stages of Penetration Testing
There are normally five different stages to a penetration test:
- Planning and inspection
- Scanning
- Gaining access
- Maintaining access
- Analysis
Planning and inspection
The first stage involves the scope and overall aim of a penetration test being defined, including the systems that the test will address and the methods of testing that will be utilized.
This stage also involves the gathering of intelligence such as mail server and domain and network names to gain a greater understanding of the workings of a network and the potential vulnerabilities it may contain.
Scanning
The second stage is to work out the ways in which the target application will react to various attempts at the intrusion, which is typically done via
- Static analysis
- Dynamic analysis
Static analysis inspects the code of an application in order to estimate its actual operational behavior, and these tools can actually have the code scanned in its entirety in just one pass.
Dynamic analysis inspects the code of an application while it is running. This is a much more practical scanning method as it offers a real-time look at the performance of an application.
Gaining Access
The third stage makes use of web application and automated attacks like backdoors, cross-site scripting, and SQL injection to discover the vulnerabilities of a target, which the testers will then attempt to exploit usually by escalating privileges, intercepting traffic, stealing data, and so forth in a bid to determine just how much damage such attacks could actually cause.
Maintaining Access
The fourth stage determines whether or not the vulnerability can be exploited to gain a persistent presence within the targeted system to allow in-depth access to a bad actor.
The overall idea is to achieve an accurate imitation of threats that are advanced and persistent that can remain in a system for months at a time in order to steal the most sensitive data in an organization.
Analysis
A report is then compiled of all the data accumulated from the penetration test that includes the vulnerabilities in website security that the security testing exploited, the length of time that the penetration tester was able to remain undiscovered in the system and the sensitive data the test was able to access.
Security personnel can then analyze this report to help reconfigure the WAF settings of an enterprise and other application security solutions in order to patch up any vulnerabilities that the test discovered and prevent future attacks.
Penetration Testing Methodology
1. External Testing
External penetration tests are targeted at company assets that can be seen via the internet such as a web application, company website, and domain name, and email servers. The aim of these tests is to get access and then extract important data.
2. Internal Testing
Internal tests see testers that have access to applications behind their web application firewall simulating what would happen if an attack was launched by a malicious insider. Malicious insiders do not have to be rogue employees but an employee that may have had their credentials stolen because of a phishing attack.
3. Blind Testing
Blind tests see a tester given the targeted enterprise’s name and nothing more, providing security personnel with a real-time examination of how real application attacks actually take place.
Conclusion
While a Web Application Firewall is imperative to protect your web applications from malicious requests, it isn’t the ultimate security solution. A WAF is supposed to be used along with security testing/penetration testing. Manual penetration testing can unearth complex security flaws and chain attacks that an automated test might not be able to pick up.
Indusface’s team of security experts is always up to date with the latest and emerging threats to provide comprehensive pen testing services for your business. Build a stronger defense and safeguard your business and customers with manual penetration testing.
