I want to perform Penetration Testing and I work only in Manual Testing. How Can I perform Penetration testing manually ?
Yes you Can, but Penetration Testing is a complete discipline in its own right. Although I carry out some manually, we often bring in specialist resource to perform it comprehensively.
I would suggest you start by getting a Pen Test Distro like Kali Linux and learn about some of the tools it includes.
Before you run ANY tests, make sure that you have agreement with your ops and development teams. Almost by definition, you can break things, so be careful!
You could self learn from OWASP ZAP.
check this out: https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project
If you want to perform Penetration Testing on any software/application, first of all you will need to gather information about that software/application, its host and environment.
As the Term suggests you need to penetrate the application under test. You can penetrate something only if you have knowledge of it and its environment. More familiar you are with the thing the better it will be for you to penetrate it.
You will have to learn about,
- The architecture of the application.
- The architecture of server hosting the application.
- Technology used for developing the application.
- Does the host have any other software that is vulnerable?
- What security measures have been implemented in the application?
- What security measures have been implemented on the server?
- The ports that the application uses to communicate.
- Other ports that are open on the server.
- And much more...
Once you have sufficient knowledge and familiarity with all these you can look for known vulnerabilities about the technology and hosting server's architecture and try to exploit them. You can also come up with ideas to break through using the code. You can attack the open ports on the server or another vulnerable application on the server to gain access to the server and hence the application.
It is kind of like a spy or secret agent trying to get confidential information from the enemy!
There's a whole lot more that you can do, but it all requires a huge number of permutations and combinations and hence people prefer using tools and automating the attacks!
In manual testing you can exploit the vulnerability of a web application. For achieving this task you can use below mentioned points:
OWASP Mutillidae is a purposely vulnerable web application containing more than 40 vulnerabilities. It includes all of the OWASP top 10 vulnerabilities. Further this application is a good platform to gain security testing services skills.
BURP Suite Proxy
There is another tool which can be used is Burp Proxy. This is an interception proxy tool that interacts between the client (a browser application, e.g., Firefox or Chrome) and the website or server.
Burp Suite intercepts that request from your machine to the server/website and you can change the request according to your needs. To intercept the request, Burp Proxy listener must be configured on a 127.0.0.1 localhost and port 8080. Then you can also set this proxy configuration in your web browser. After doing so, go to Burp Suite => proxy tab => Intercept is on (make sure this button is pressed).
Before starting to perform any penetration testing you should document/research about what this type of testing implies.You can check owasp top 10.
Make sure you have permissions to test if you want to do this at work.
Create a plan with what things you want to cover.
Make sure you know what are you doing, when you submit some code you should know the possible result else you might do things like: delete databases, introduce vulnerabilities, block the testing environment.
If possible you should ask for a dedicate environment an you should not test on the same environment where: some other testers are testing in the same time as you do, automation suite is running, a demo is held, other members of the team depend on that environment.
If you plan to use some tools in the future, use known tools that you trust. Another thing you could do is to find some vulnerable apps and tutorials to gain some knowledge. An example of vulnerable web app is webgoat. Please note that testing vulnerable apps locally should be done in a controlled environment, consider using a VM with no access to the internet.