Types of Penetration Tests
Now that we have looked at seven PTEST categories lies look at type main types of penetration testing which is used in the field, we have overt and covert, a Overt pen test or also know as “white box” test, occurs with the organisations full knowledge, Covert testing are designed to simulate the actions of a real attacker, both tests have the advantages and disadvantages.
Overt Penetration Testing
Using overt penetration testing you work with the organisation it identify potential security threats, and the organisations IT or security team shows you the organisations IT infrastructure, this gives one main benefit for a overt tester is that you have access to insider knowledge and can launch attacks without fear of being blocked, the downside to a test like this is that it might not fully test the effectiveness of the clients incidence response program, or fully identify how well the security program detects certain attacks, when time is limited and certain PTES steps such as intelligence gathering are out of scope, an overt test may be the best option.
Covert Penetration Testing
Different to overt testing, covert penetration testing is designed to simulate the actions of an attacker and its performed without the knowledge of most of the organisation, covert tests are preformed to test the internal security teams ability to detect and respond to an attack, covert tests are performed to test the internet security teams ability to detect the response of an attack.
covert tests can be costly and time consuming, they require more skill than overt tests, in the eyes of penetration testers in the security industry the convert scenario is often preferred because it most closely simulates a true attack, covert attacks rely on your ability to gain information by recognisance their form, as covert tester you will typically not attempt to find a large number of vulnerabilities in a target but will simply attempt to find the easiest way to gain access to a system, undetected.
Vulnerability scanners are automated tools that can be used to identify security flaws affecting a given system or application, vulnerability scanners typically work by fingerprinting a targets operating system, meaning identifying the version and type, as well as any services that are running, once you have fingerprinted a targets operating system, you use the vulnerabilities that are held within the scanners database to check against the target for available vulnerabilities that exist.
Of cause these checks are only as good as their creators, and with any fully automated solutions, they can sometimes miss or misrepresent vulnerabilities on a system or potential new exposure that might be exploited by hackers.
Vulnerability scanners play a very important role in penetration testing. especially in the case of overt testing, which allows you to launch multiple attacks without having the worry about avoiding detection, the wealth of knowledge gleaned from vulnerability scanners can be invaluable, but beware on fully relying on them to heavily, the beauty of penetration test is that it can be automated, and attacking systems successfully requires that you have the knowledge and the skill, in most cases when you become a skilled penetration tester you will rarely use a vulnerability scanner but will rely on your knowledge and expertise to compromise a system.
Types of Penetration Tests – All together now
If like me you are new to penetration testing or haven’t really adopted a formal methodology, study PTES as with any experiment, when performed a penetration test, ensure you have a refined and adaptable process that is also repeatable, as a penetration tester, you need to ensure that you intelligence gathering and vulnerability analysis are as expert as possible, to give you and advantage in adapting to scenarios as they present themeless.