Pentesting: hacking systems for the common good

We define a penetration test as a ethical cyber-security practice aimed at discovering, studying and remediating vulnerabilities within a network of computer systems. The point behind penetration testing is that it uses the same tactics and trickery that cybercriminals use to attack a computer system. In this way, engineers can ascertain how resilient the cyber security protocols in place are in responding effectively to potential threats.

In this Euroinnova article we will talk about the different types of penetration tests and how cybersecurity teams put them into practice in their workspace. In addition, if you are interested in training in cybersecurity, we recommend that you take a look at our catalogue of masters in cybersecurity.

Types of penetration tests

Depending on the software or the aspect of the network we want to focus on, we can categorise the types of penetration testing as follows:

Network testing

They focus on identifying vulnerabilities in the network infrastructure, such as:

• Routers: Exploitation of firmware or configuration vulnerabilities to gain unauthorised access.
• Switches: MAC address spoofing or denial of service (DoS) attacks to disrupt traffic.
• Firewalls: Port and protocol scanning to find unauthorised access routes.
• Wireless devices: Data interception or brute force attacks against WPA/WPA2 keys.

Application testing

They assess the security of web, mobile and desktop applications. They look for vulnerabilities such as:

• SQL Injection: Manipulation of database queries to gain unauthorised access to sensitive data.
• Cross-site scripting (XSS): Injection of malicious JavaScript code into web pages to steal cookies or redirect users.
• Cross-site request forgery (CSRF): Tricking users into performing unauthorised actions in web applications.
• Authentication vulnerabilities: Weak passwords, lack of two-factor authentication or session management errors.

Social engineering tests

They are based on psychological manipulation to gain sensitive information or access to systems. Some techniques are:

• Phishing: Sending fraudulent emails or messages to trick users and obtain their credentials.
• Baiting: Leaving infected devices or USB sticks in public places for users to pick up and plug into their computers.

Testing in the cloud

They focus on the security of cloud platforms and services, such as:

• Amazon Web Services (AWS): Search for permission misconfigurations or vulnerabilities in S3 or EC2 services.
• Microsoft Azure: Vulnerabilities in the Azure infrastructure or in the applications developed for the platform.
• Google Cloud Platform (GCP): Security analysis of Google Kubernetes Engine containers or Cloud SQL databases.

Hardware testing

They assess the hardware security of devices, such as:

• Printers: Interception of sensitive data or manipulation of firmware to gain unauthorised access.
• Smartphones: Attacks via USB or Bluetooth interfaces, or scanning for vulnerabilities in the device's operating system.
• IoT devices: Vulnerabilities in the firmware or configuration of devices such as routers, IP cameras or smart TVs.

Black box vs. white box vs. grey box

The fact that the tester knows to a greater or lesser extent how the company's computer networks are constructed and where the information is hosted can make the pentesting results vary greatly. In this respect, we differentiate between black box, white box and grey box.

White box

The white box penetration test consists of share all information with the tester of the system, such as network maps and credentials (passwords, IPs, etc.). In this way, we can more directly and accurately assess the cyber security measures of a system as a whole in a shorter time. It is also useful to simulate a cyber attack if it came from someone inside the company.

Black box pentesting

In contrast to white box pentesting, black box pentesting, the tester is not provided with any information, The tester must therefore manage to get through all the security controls and obtain the necessary credentials to detect a vulnerability. Thus, the tester has to manage to get through all the security controls and obtain the necessary credentials to detect any vulnerabilities. Although this option is the most expensive, it is the one that most closely resembles a real external cyber attack.

Grey box pentesting

In this case, it is neither one thing nor the other; partial information about the network structure of the system is provided to the tester. This tactic is used when our computer system has access permissions stratified by levels. With this, you want to check to what extent a user with certain credentials could browse and find out to what extent they could cause damage to the system.

Pentesting process

While all companies have their own pentesting protocols, they all follow a similar process for planning, documenting and drawing their conclusions from the penetration tests they choose to implement.

• Planning and reconnaissance: The first step is to define what is to be assessed, which parts of the company's systems or applications, the type of testing that is appropriate in each case and the level of depth to be explored. Information is gathered about the company and its technologies, and a risk analysis is carried out to identify possible threats and vulnerabilities.
• Scanning: Automated tools are used to identify vulnerabilities in systems and applications. Subsequently, manual tests are performed to verify the vulnerabilities found and the extent to which they could adversely affect the system if it were to respond to an attack.
• Operation and access: Attempts are made to circumvent system cybersecurity measures at all costs by exploiting vulnerabilities found to gain access to confidential systems and data. The potential impact an attacker could cause is assessed, including the theft of sensitive data, disruption of network operations and damage to the company's reputation.
• Registration: All steps of the pentesting process and other relevant details, such as the tools and techniques used, the vulnerabilities found and the test results, are documented. Finally, a report is generated with the test results and recommendations for security improvements.
• Pentesting automation: To save time and improve productivity, automation tools are used to set up the same penetration tests on a regular basis.