Penetration testing is performed by a group of security experts, typically external contractors, who attempt to exploit system vulnerabilities to actively break into a company’s network or compromise IT systems.
There are several approaches to pentesting—from black box testing in which the tester has zero knowledge of the target environment, to white box in which the tester has complete knowledge. There are also many types of penetration tests, targeting different layers of the IT environment, including the network, applications, physical security controls, client devices, and even mobile and IoT devices.
Read on to learn about these penetration testing types and more.
Penetration Testing Methodologies
There are three key approaches to penetration testing, which can be used to check for vulnerabilities found in corporate systems.
1. Black Box Penetration Testing
Performed by a remote attacker, in similar conditions to a real attack. This means that the organization provides little or no information to the penetration tester before testing begins.
The penetration tester only knows the name of the target organization (often an IP address or URL). Therefore, the potential attack surface is very large. The attacker performs reconnaissance, explores vulnerabilities discovered in potential target systems, and plans their attack based on information discovered.
Black box penetration testing gives penetration testers the freedom to choose targets and vulnerabilities to maximize the impact of an attack, just like in a real security breach. For the tester, this kind of audit requires little preparation.
One of the advantages of this method is that penetration testers can evaluate potential entry points from an attacker’s perspective. This avoids testing only what the organization considers important for security.
Black box penetration testing can also check the organization’s ability to detect an attack and respond quickly and effectively. This is in case the security teams are not notified about the attack.
2. White Box Penetration Testing
Unlike black box testing, in this type of security testing means sharing as much information as possible with penetration testers beforehand. The term “white box” is used because the tester has complete visibility into how the organization’s systems work.
Information may include architectural documentation, administrator access to servers, access to source code, and more.
The white box security audit is not a penetration test by itself. Because the auditor does not have the perspective of an attacker. Compared to penetration testing, this is a more comprehensive security analysis that will give you a better understanding of where security issues lie. It can uncover vulnerabilities that may be missed in a regular penetration test, but could still pose a security risk.
3. Gray Box Penetration Testing
A pen tester starts with some information about the organization. This includes providing information about the behavior of tested systems, limited access to user accounts on the platform, and providing access to some systems that are not publicly accessible. This allows for more detailed testing with more context.
In gray box security audits, the attack surface is a defined range. Tests can be performed on elements like highest risk areas, sensitive systems, internally accessible systems, etc). Therefore it can also simulate attacks by insiders—customers, partners, visitors, or employees.
One of the advantages of this method is that you can set an exact test scope based on your priorities. For example, you can specifically test a new release to production, or specific features that are critical for your customers.
8 Types of Penetration Tests
Here are eight penetration test types you can use to test your security posture and defenses.
1. Web Application Penetration Testing
Web application penetration testing is used to discover vulnerabilities or security gaps in web-based applications. The goal is to identify security weaknesses or vulnerabilities in applications and components like databases, source code, and backend networks and provide practical solutions for remediation.
The penetration tester uses at least three steps to evaluate your web application:
- Reconnaissance—gathering information about the operating system, services, and resources being used.
- Discovery—attempting to find vulnerabilities.
- Exploit—using the vulnerabilities to gain unauthorized access to sensitive data or systems.
Learn more in our guide to penetration testing steps.
2. Network Penetration Testing
Identifies the most easily exposed vulnerabilities and security weaknesses in your organization’s network infrastructure, and attempts to exploit them. This includes servers, firewalls, switches, routers, printers, workstations, and so on.
Network penetration testing can protect an organization from common network-based attacks such as firewall configuration errors, router/switching attacks, evasion of IPS or IDS systems, DNS attacks, SSH attacks, proxy attacks, database attacks, man-in-the-middle attacks and FTP/SMTP attacks.
3. Wireless Penetration Testing
Identifies risks and vulnerabilities related to wireless networks. Testers look for vulnerabilities like authentication attacks, configuration errors, session reuse, and malicious wireless devices.
Wireless communication is an invisible service through which data enters and leaves a network. Penetration tests can help prevent unauthorized access and data leakage.
4. Physical Penetration Testing
Checks for physical security risks and vulnerabilities affecting the company’s computer systems. Testers evaluate weaknesses such as social engineering, shoulder-surfing or tailgating, or badge forging.
In most companies, physical barriers are not a top priority for cybersecurity teams. But if a malicious attacker physically accesses the server room, they could compromise the entire network.
The biggest advantage of physical penetration testing is that it reveals the weaknesses and vulnerabilities of physical controls (locks and physical access mechanisms, security cameras and security guards). By identifying these weaknesses, you can quickly take action to improve physical security mechanisms.
5. Social Engineering Penetration Testing
Involves an attempt by the penetration tester to convince or trick a user into providing sensitive information such as a username or password. This can reveal gaps in employee awareness, and test the effectiveness of security mechanisms like email spam filters.
Research shows that a vast majority of cyberattacks rely on social engineering. Insider threats and compromised accounts are one of the biggest cybersecurity threats facing organizations today. Social engineering testing and awareness programs have proven to be one of the most effective ways to mitigate these types of attacks.
6. Client Side Penetration Testing
Looks for security vulnerabilities in any type of software that can be exploited on client computers, such as employee workstations. Examples include web browsers like Google Chrome, Firefox or Safari; content creation software packages like MadCapFlare or FrameMaker, media players, etc.
You can perform client-side testing to prevent attacks like:
- Cross-site scripting (XSS)
- Cross-origin resource sharing (CORS)
- Clickjacking and form hijacking
- HTML injection
- Malicious redirection
- Client-side malware infection
7. IoT Penetration Testing
Tests connected devices to reveal security vulnerabilities across the entire IoT ecosystem—hardware, embedded software, communication protocols, servers, web and mobile applications.
Hardware, firmware, and communication protocol testing should be appropriate to the device being tested. For example, testers can attempt to breach device authentication, or perform data dumps through firmware vulnerabilities or signal capture.
8. Mobile Application Penetration Testing
Tests run on mobile applications, excluding mobile APIs and servers. This typically involves two types of tests:
- Static analysis—involves extracting elements (both metadata and source code) and using them to perform reverse engineering on the application.
- Dynamic analysis—involves finding vulnerabilities while the application is running on the device. For example, testers may attempt to bypass controls or extract data from RAM.
Conclusion
There are many ways to do penetration testing, and each type of test can provide different insights about an organization’s security posture and defenses. As an organization, consider which parts of your infrastructure are the most vulnerable, or least understood, to perform your first penetration tests. Over time, try to test your entire IT environment to ensure you don’t miss important security gaps and vulnerabilities, which may otherwise remain invisible.
