Pentest Process

In this post, we explain each phase of a penetration test in detail. If you are new to pentesting and would like to learn more about pentesting in general, read our post Penetration Testing: How Secure Is Your Company Really?.

Contents:

• Pentest process: step by step
• Summary

Pentest processes define different approaches to how pentests are organized and carried out. There are various pentest methods for uncovering security vulnerabilities in a company. Each method describes the process a company can use to uncover these vulnerabilities. Companies can use their own processes, but many established, industry-recognized methods are a good option for companies. Some companies use these methods as an “out-of-the-box” solution, while others use them as a foundation to build on.

There is no doubt that regular penetration tests are an essential part of the vulnerability management process for reducing risk. It is important to ensure that penetration tests are efficient, and using the right penetration testing method is an essential part of this. In this context, a methodology defines the logic according to which different test cases are carried out to assess the security of an asset.

Several standards and frameworks for penetration testing have been published in the past. Pentest processes play a comprehensive role in benchmarking practices. For example, the OWASP Top 10 application security risks are the standard for assessing web applications. NIST SP 800-115 (Technical Guide to Information Security Testing and Assessment), the Open Source Security Testing Methodology Manual (OSSTMM), the Penetration Testing Execution Standard (PTES) and, in Germany, the BSI's implementation concept for penetration tests are further methods and standards followed by organizations worldwide. OWASP, the CIS Benchmarks and the CIS Controls (v8.1) are common references for vulnerability testing.

We explain the different types of pentests – such as network pentests, web application pentests and social engineering pentests – in detail in our post Penetration Testing: How Secure Is Your Company Really?. In this post, we focus on the process.

Pentest process step by step

Pre-engagement, planning and objectives agreement

The first step in the pentest process is creating the test plan. A well-designed plan provides a path through a company's complex IT structure. To start creating a plan, you need to fully understand the organization and how it works. Knowledge of its systems and applications is also important. Once we have this information, we can start defining the scope of the test.

Defining a precise scope of work ensures understanding and clarity regarding objectives, exclusions and what to do if something goes wrong. We use a proven project management approach and make sure that, before the engagement begins, all parties are informed about authorization forms and legal aspects, in-scope items, vulnerable components and out-of-scope components.

Intelligence gathering and discovery

Once the legal and project-related formalities have been completed, the reconnaissance phase begins, whose sole aim is to obtain information. This information (e.g. network layouts, domains, servers, infrastructure details) helps to understand how the network works, including its assets (applications, systems, devices, anything with an IP).

It is also necessary to carry out proper reconnaissance and gather information about the systems. Using various automated and manual tools, the testers scan the system to find potential vulnerabilities or entry points. These would then be exploited by the testers in later steps. Tools such as Recon-Ng, Nmap, Spiderfoot, Metasploit and Wireshark are typically used for this.

Scanning

In this phase, vulnerabilities within the defined targets are identified. It includes scanning the target for listening services/open ports, fingerprinting and analyzing the running services in order to draw up a rough attack plan for the target system.

It is worth noting that host scanning is the first step of a typical network penetration test. Here, the pentesters scan the hosts to check whether there are any technical issues (firewalls, connection problems, etc.). The host scan also serves to define the test scope.

Exploitation

Once potential vulnerabilities have been discovered, the testers use them for further attempts to penetrate the system. This closely resembles the way a cybercriminal would exploit these vulnerabilities and contributes to a better overall understanding. All steps, tools used, locations and input methods for a particular issue are documented appropriately to record the entire process for later review. As one step in the penetration testing process, these security issues are ranked according to how easy they are to exploit and how much damage they could cause. This is a great help to the company in setting priorities for remediation.

Specific assessments and targeted scenarios are defined in “white box”, “black box” or “gray box” methods. The test cases are defined on the basis of the information available to the consultants before the assessment begins.

Data analysis and reporting

After the penetration tests have been completed, detailed reports are prepared for remediation. These reports list all identified vulnerabilities and the recommended remediation measures. You can adapt the format of the vulnerability report (HTML, XML, MS Word or PDF) to the needs of your organization.

Presentation of the results

It is crucial that the results of the pentests are presented thoroughly, including an explanation of the vulnerabilities, further exploitation results, an overview of user rights management, and the critique and results of the pre-agreed scenarios. And last but not least, the pentesters' recommendations for fixing the vulnerabilities.

At the end of the day, all of the customer's questions should be answered and a concrete set of measures should be defined for each vulnerability. Only then does a pentest make sense.

Retest

For some projects it can make sense to scan and check the findings again in order to verify the effectiveness of the measures taken. We therefore recommend a retest, usually 1 to 3 months after the report – once the measures have been implemented. The pentester should already schedule this time in the closing meeting in which the results are presented.

Summary: pentest process

In this blog post, we explained what a standard pentest process looks like. We went through the pentest phases from beginning to end. Of course, pentests can be carried out in different ways, as there is a wide range of hardware/software on the market.

Please bear in mind that the quality of a pentest depends heavily on the experience of the pentester. In other words, an experienced pentester may try to exploit different vulnerabilities based on their experience.

If you would like more general information about pentesting, you can read our blog post on everything you need to know about penetration testing here. If you would like to get started, see how we can help on our penetration testing services page.