0

Is Penetration Testing a Tester's job/task?

What are the available tools for penetration testing?

How to perform penetration testing?

3 Answers 3

4
+50

It is also called as- "network penetration testing" or “security testing”. It’s the process to identify security vulnerabilities in an application by evaluating the system or network with various malicious techniques. Purpose of this test is to secure important data from outsiders like hackers who can have unauthorized access to system. Once vulnerability is identified it is used to exploit system in order to gain access to sensitive information.

Causes of vulnerabilities:

  1. Design and development errors
  2. Poor system configuration
  3. Human errors

Why need of Penetration testing?

  1. Financial data must be secured while transferring between different systems
  2. Many clients are asking for pen testing as part of the software release cycle
  3. To secure user data
  4. To find security vulnerabilities in an application

Examples of Penetration testing tools:

Nmap, Nessus, Metasploit, Wireshark, OpenSSL, Cain & Abel, THC Hydra, w3af..etc

2

Penetration testing (also called pen testing) is the practice of testing a computer system, network or Web application to find vulnerabilities that an attacker could exploit. Finding these vulnerabilities gives the opportunity to correct and prevent potential future occurrences.
Testers should consider security testing as part of their role. The amount of resources to devote will depend on many factors such as company size, industry, product, etc.

For tools, here is a list of 37:
http://www.softwaretestinghelp.com/penetration-testing-tools/
The top 3 on the list are:
http://cdn.softwaretestinghelp.com/wp-content/qa/uploads/2013/11/Metasploit-pentesting-tool.jpg http://cdn.softwaretestinghelp.com/wp-content/qa/uploads/2013/11/Wireshark-logo.jpg http://cdn2.softwaretestinghelp.com/wp-content/qa/uploads/2013/11/w3af4.png

Tools for penetration testing can be classified into two kinds: scanners and attackers

You perform penetration testing (without or without the use of a tool) by issuing network queries to find vulnerabilities.

3
  • what you mean is.. we have to think like an hacker right? Commented Apr 5, 2016 at 13:22
  • 1
    Its actually more difficult because you have constraints on what you are allowed to do.
    – David Cain
    Commented Apr 5, 2016 at 17:29
  • @PaarthibanNK - no, you need to think like a cracker. :-) Hacking is something different, learn your terminology because you are talking to programmers, not clueless public (which uses "hacking" to describe cracking). en.wikipedia.org/wiki/Hacker_%28expert%29 Commented Apr 11, 2016 at 14:47
1

Penetration testing is typically performed by specialized professionals known as penetration testers or ethical hackers. While it shares some similarities with software testing, penetration testing focuses specifically on identifying vulnerabilities and potential security risks in a system or application.

There are various tools available for penetration testing, depending on the specific requirements and scope of the testing. Some popular tools include Nmap, Metasploit, Burp Suite, Wireshark, Nessus, etc.

Performing penetration testing typically involves the following steps:

Planning and Scoping: Define the scope of the penetration test, including the target systems, applications, and specific objectives. Understand the rules of engagement and legal considerations.

Reconnaissance: Gather information about the target systems, such as IP addresses, network topology, and potential vulnerabilities.

Vulnerability Assessment: Identify and assess potential vulnerabilities in the target systems or applications using tools like port scanners, vulnerability scanners, and manual inspection.

Exploitation: Attempt to exploit identified vulnerabilities to gain unauthorized access or perform specific actions that validate security weaknesses.

Post-Exploitation: Document the results, including successful exploits, compromised systems, and recommendations for remediation. Provide a detailed report of the findings to stakeholders.

Remediation: Work with the relevant teams to address and fix the identified vulnerabilities and security weaknesses.

It's important to note that penetration testing should be performed by experienced professionals who follow ethical guidelines and obtain appropriate permissions to conduct the testing.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.