Introduction to Penetration Testing

Penetration testing (pentesting) is the practice of simulating real-world attacks against systems, networks, and applications — with explicit authorisation — to identify vulnerabilities before malicious actors do. This lesson covers the fundamentals: what pentesting is, the different types, industry-standard methodologies, and the critical legal and ethical framework you must follow.

---

Important: Every technique in this course must only be used on systems you own or have written permission to test. Unauthorised access to computer systems is a criminal offence in virtually every jurisdiction.

---

What Is Penetration Testing?

A penetration test is a controlled, authorised attempt to exploit vulnerabilities in a target system. The goal is to:

• Discover security weaknesses before attackers do
• Demonstrate the real-world impact of those weaknesses
• Provide actionable remediation recommendations
• Validate that existing security controls work as intended

Pentesting vs Vulnerability Scanning

Aspect	Vulnerability Scan	Penetration Test
Automation	Fully automated	Manual + automated
Depth	Surface-level	Deep exploitation
False positives	Common	Verified by exploitation
Risk demonstration	Theoretical	Proven impact
Frequency	Weekly/monthly	Quarterly/annually
Skill required	Low–medium	High

---

Types of Penetration Testing

By Knowledge Level

	Black Box	Grey Box	White Box
Knowledge	No internal knowledge	Partial knowledge (some creds, limited docs)	Full access to source, architecture, credentials
Simulates	An external attacker	An insider or partner	An insider with full access

Type	Knowledge Given	Simulates	Time Required
Black box	None	External attacker	Longest
Grey box	Partial (e.g. user creds)	Insider / partner	Medium
White box	Full (source code, diagrams)	Trusted insider	Shortest

By Target

• Network pentest — internal/external infrastructure, servers, firewalls
• Web application pentest — websites, APIs, authentication flows
• Mobile application pentest — iOS/Android apps and their backends
• Wireless pentest — WiFi networks, Bluetooth
• Social engineering — phishing, pretexting, physical access
• Cloud pentest — AWS, Azure, GCP configurations
• IoT pentest — embedded devices, firmware

---

Penetration Testing Methodologies

OWASP Testing Guide

The Open Web Application Security Project provides a comprehensive testing guide focused on web applications:

• 66 controls across 11 categories
• Detailed test procedures for each control
• Regularly updated to reflect new attack vectors
• Free and community-driven

PTES (Penetration Testing Execution Standard)

graph TD
  A["1. Pre-engagement"] --> B["2. Intel Gathering"]
  B --> C["3. Threat Modelling"]
  C --> D["4. Vuln Analysis"]
  D --> E["5. Exploitation"]
  E --> F["6. Post-Exploitation"]
  F --> G["7. Reporting"]

Seven phases: Pre-engagement Interactions, Intelligence Gathering, Threat Modelling, Vulnerability Analysis, Exploitation, Post-Exploitation, Reporting.

OSSTMM (Open Source Security Testing Methodology Manual)

• Focuses on operational security and measurable results
• Defines a Risk Assessment Value (RAV) for quantifiable metrics
• Covers five channels: Human, Physical, Wireless, Telecommunications, Data Networks

NIST SP 800-115

• US government standard for technical security testing
• Covers planning, execution, and reporting phases
• Often required for government/defence contracts

---

Legal and Ethical Considerations

Always Get Written Authorisation

Before any testing begins, you must have:

1. A signed contract / statement of work (SOW)
2. Written authorisation (permission to test)
3. Clearly defined scope — what is in/out of bounds
4. Rules of engagement — hours, techniques, escalation procedures
5. Emergency contact details — who to call if something breaks
6. Data handling agreement — how findings and captured data are stored/destroyed

Rules of Engagement (RoE) Checklist

Item	Description
Scope	IP ranges, domains, applications in scope
Exclusions	Systems/networks explicitly excluded
Testing window	Permitted hours/days (e.g. business hours only)
Allowed techniques	Social engineering, DoS testing, physical access?
Notification	Will defenders (SOC/blue team) be informed?
Data handling	Encryption, storage, deletion timeline
Escalation procedure	Steps if critical vulnerability or system crash occurs
Point of contact	Client-side and tester-side emergency contacts

Relevant Laws

Jurisdiction	Law
UK	Computer Misuse Act 1990
US	Computer Fraud and Abuse Act (CFAA)
EU	Directive 2013/40/EU on attacks against info systems
Australia	Criminal Code Act 1995, Part 10.7

Remember: "I was just testing" is not a legal defence without written authorisation.

---

The Pentest Lifecycle

graph TD
  A["1. Scoping & Planning"] --> B["2. Reconnaissance"]
  B --> C["3. Scanning & Enumeration"]
  C --> D["4. Exploitation"]
  D --> E["5. Post-Exploitation"]
  E --> F["6. Reporting"]
  F --> G["7. Remediation & Retesting"]

Each phase builds on the previous one. This course dedicates a lesson to each major phase.

---

Essential Pentesting Platforms

Platform	Type	Description
Kali Linux	OS	Debian-based distro with 600+ security tools
Parrot OS	OS	Security-focused distro, lighter than Kali
HackTheBox	Lab	Online platform with vulnerable machines
TryHackMe	Lab	Guided learning paths with virtual rooms
VulnHub	Lab	Downloadable vulnerable VMs
DVWA	Practice app	Deliberately vulnerable web application

---

Certifications Roadmap

graph TD
  A["Beginner: CompTIA Security+ / CEH"] --> B["Intermediate: eJPT / PNPT"]
  B --> C["Advanced: OSCP / OSWE / GPEN"]
  C --> D["Expert: OSCE3 / OSEE / GXPN"]

---

Summary

• Penetration testing is the authorised simulation of real attacks to find vulnerabilities.
• Tests can be black, grey, or white box depending on the information provided.
• Industry methodologies include OWASP, PTES, OSSTMM, and NIST SP 800-115.
• Legal authorisation and clearly defined rules of engagement are mandatory before any testing.
• The pentest lifecycle flows from scoping through reconnaissance, scanning, exploitation, post-exploitation, and reporting.
• Always operate within legal and ethical boundaries — never test without permission.