Penetration Testing – Software Engineering

What is penetration testing?

A penetration test, also known as a “pen test” is a simulated cyber attack on a computer system, network, or web application. The purpose of a penetration test is to identify vulnerabilities in the system that an attacker could exploit and to evaluate the effectiveness of the system’s security controls.

Once the test is complete, the team will provide a report detailing their findings and recommendations for mitigating the identified vulnerabilities. The goal of a penetration test is not to cause harm to the system but to identify and help fix security weaknesses before they can be exploited by malicious actors. It is important to note that there are different types of penetration testing, such as External Penetration testing, Internal Penetration testing, and Web application penetration testing. Each of them has its scope, methodology, and objectives.

History of the Penetration Test:

In 1965 security concerns rose, because many thought that communication lines could be penetrated and the attacker/hacker might be able to get the data that is being exchanged between one person to another person. In an annual joint conference of 1967 various computer experts stated this point that communication lines can be penetrated.

In the 1980s, the rise of personal computers and the internet led to an increased need for network security testing. In the 1990s, the field of penetration testing continued to evolve, with a greater focus on automated testing and the use of commercial tools. The growth of e-commerce and the increasing reliance on the internet for business led to a greater need for web application security testing.

Today, penetration testing is an integral part of cybersecurity, with organizations of all sizes and in all industries conducting regular testing to identify and mitigate vulnerabilities in their systems. The penetration testing process is continuously evolving to adapt to new technologies and threat scenarios.

Types of Penetration Testing:

Black Box penetration testing 

Grey Box Penetration testing

White Box Penetration testing

Black Box Penetration Testing:- In this Method attacker does not know the target as it exactly simulates an actual cyber attack where an actual black hat hacker attacks. This testing takes time as the attacker does not know the system so he gathers them. This method is used to find existing vulnerabilities in the system and to simulate how far a hacker can go into the system without any info about the system.

Grey Box Penetration Testing:- In this method, the attacker is provided with a bit more information about the target like network configurations, subnets, or a specific IP to test, Attacker has a basic idea of how the machine is to which he/she is going to perform an attack, they may also be provided with low-level login credentials or access to the system which helps them in having a clear approach, This saves time of Reconnaissance the target.

White Box Penetration Testing:- We can say that in this testing method attackers have developer-level knowledge about the system which also includes an assessment of source code, Ethical hackers have full access to the system more in-depth than black box testing. It is used to find out potential threats to the system due to bad programming, misconfigurations, or lack of any defensive measures.

Advantages of the Penetration test:

• The penetration test can be done to find the vulnerability which may serve as a weakness for the system.
• It is also done to identify the risks from the vulnerabilities.
• It can help determine the impact of an attack and the likelihood of it happening.
• It can help assess the effectiveness of security controls.
• It can help prioritize remediation efforts.
• It can ensure that the system is secure.
• It can be used to test the security of any system, no matter how large or small.
• It can be used to find vulnerabilities in systems that have not yet been exploited.
• It can be used to assess the effectiveness of security controls in place.
• It can be used to educate employees about security risks.

Disadvantages of the Penetration test:

• The penetration test which is not done properly can expose data that might be sensitive and more.
• The penetration tester has to be trusted, otherwise, the security measures taken can backfire.
• It is difficult to find a qualified penetration tester.
• Penetration testing is expensive.
• It can be disruptive to business operations.
• It may not identify all security vulnerabilities.
• It may give false positives (incorrectly identifying a vulnerability).
• It may give false negatives (failing to identify a vulnerability).
• It may require specialized skills and knowledge.
• The results may be difficult to interpret.
• After the penetration test is completed, the system is vulnerable to attack.

Phases of Penetration Testing Process: 

Phases of Penetration Testing

1. Reconnaissance: 

This phase is also known as the planning phase. In this phase, important information about the target system is gathered. Reconnaissance is the first phase of the penetration testing process. It involves gathering information about the target system or network to identify potential vulnerabilities and attack vectors. During the reconnaissance phase, the penetration tester will gather information from a variety of sources, including. Publicly available information, such as company websites, social media accounts, and domain name registration records
Network scanning tools, which can be used to identify live hosts, open ports, and running services
Vulnerability scanning tools, which can be used to identify known vulnerabilities in the system
OSINT (Open-Source Intelligence) techniques, can be used to gather information from various sources such as Google, social media, and other public domains.
The goal of reconnaissance is to gather as much information as possible about the target system or network, to identify potential weaknesses that can be exploited during the later phases of the penetration test.

It is a crucial step of the penetration testing process as it allows the testers to understand the target system environment and to define the scope of the test.

2. Scanning: 

In this phase, different scanning tools are used to determine the response of the system towards an attack. Vulnerabilities of the system are also checked. Scanning is the second phase of the penetration testing process, following reconnaissance. It involves using automated tools to actively probe the target system or network to identify live hosts, open ports, and running services.

During the scanning phase, the penetration tester will use a variety of tools to perform different types of scans, such as:

• Port scans: which identify open ports on live hosts, and the services running on those ports.
• Vulnerability scans: search for known vulnerabilities in the system based on the version and configuration of the software running on the open ports.
• Network mapping: this creates a visual representation of the target network, including the hosts, devices, and services. Scanning can be done internally or externally, depending on the scope of the test and the objectives of the organization.

It is an important phase of the penetration testing process as it allows the testers to identify the attack surface of the target system, and to identify potential vulnerabilities that can be exploited during the next phase of the test.

It is important to note that the results of the scan may not necessarily be accurate and should be verified by a human tester to avoid false positives.

3. Gaining Access:

In this phase using the data gathered in the planning and scanning phases, a payload is used to exploit the targeted system. Gaining access is the third phase of the penetration testing process, following reconnaissance and scanning. In this phase, the penetration tester will attempt to exploit the vulnerabilities identified in the previous phases to gain unauthorized access to the target system or network.

During the gaining access phase, the penetration tester will use a variety of techniques, such as:

• Exploiting software vulnerabilities: using known exploits to gain access to a system or network.
• Social engineering: tricking employees or users into revealing login credentials or other sensitive information.
• Password cracking: using automated tools to guess or crack passwords.

The goal of this phase is to gain access to the system and to establish a foothold from which the penetration tester can move laterally through the network. It is an important phase of the penetration testing process as it allows the testers to assess the real impact of the identified vulnerabilities and to evaluate the effectiveness of the security controls in place. It is important to note that gaining access should be done in a controlled environment, with proper permissions and guidelines, and not to cause any harm to the system or data.
 

4. Maintaining Access: 

This phase requires taking the steps involved in being able to be continuously within the target environment to collect as much data as possible. 
 Maintaining access is the fourth phase of the penetration testing process, following reconnaissance, scanning, and gaining access. In this phase, the penetration tester will focus on maintaining their access to the target system or network and expanding their control over it.

During the maintaining access phase, the penetration tester will use a variety of techniques, such as:

• Establishing backdoors: creating a way to regain access to the system in case the initial access is closed.
• Privilege escalation: increasing their level of access to the system, from a low-privilege user to an administrator or root user.
• Persistence: maintaining access to the system over time by creating a way to bypass security controls.
• Lateral movement: moving through the network to gain access to other systems and resources.

The goal of this phase is to maintain access to the system or network for as long as possible and to expand the scope of the attack. It is an important phase of the penetration testing process as it allows the testers to assess the impact of a successful attack and to evaluate the effectiveness of the security controls in preventing or detecting prolonged unauthorized access.

It is important to note that maintaining access should be done in a controlled environment, with proper permissions and guidelines, and not to cause any harm to the system or data.

5. Be hidden from the user:

This is the moment where the attacker will have to clear the trace of any activity done in the target system. It is done to remain hidden from the user/victim. In the final phase of a penetration test, the tester will focus on being hidden from the user. This phase is also known as “covering tracks.” The goal of this phase is to make it as difficult as possible for the system administrator or security team to detect the tester’s presence and activities on the system.

During the covering tracks phase, the penetration tester will use a variety of techniques to hide their presence, such as:

• Clearing logs: deleting or modifying system logs to remove any evidence of the tester’s activities
• Hiding files: using techniques such as rootkits or hidden directories to conceal files and tools used during the test.
• Disabling security controls: disabling or circumventing security controls such as firewalls, intrusion detection systems, and antivirus software to evade detection.

It is an important phase of the penetration testing process as it allows the testers to assess the ability of the system to detect and prevent prolonged unauthorized access and to evaluate the incident response plan of the organization.

It is important to note that covering tracks should be done in a controlled environment, with proper permissions and guidelines, and not cause any harm to the system or data. Also, the tester must leave the system in its initial state after the test.

Rules of Penetration testing Process:

Some rules have to be followed when conducting the penetration test like the methodology that should be used, the start and the end dates, the goals of the penetration test, and more. To make the penetration test possible, there should be a mutual agreement between both the customer and the representative. These are some of the things which are commonly present in rules which are as follows:-

1. There will be a non-disclosure agreement where there will be written permission to hack. This non-disclosure agreement will have to be signed by both parties.
2. There should be a start and end date for penetration testing.
3. What methodology should be used for conducting the penetration test?
4. There should be the goals of the penetration test.

Penetration testing tools:

1. Nmap: It is a network exploration tool and security scanner. It can be used to identify hosts and services on a network, as well as security issues.
2. Nessus: It is a vulnerability scanner. It can be used to find vulnerabilities in systems and applications.
3. Wireshark: It is a packet analyzer. It can be used to capture and analyze network traffic.
4. Burp Suite: It is a web application security testing tool. It can be used to find security issues in web applications.