Penetration testing in simple terms is a simulation of a process a hacker would use to launch an attack on a business network, attached devices, network applications, or a business website. The purpose of the simulation is to identify security issues before hackers can locate them and perform an exploit.

Pen tests identify and confirm actual security issues and report on the manner in which the security issues can be located and exploited by hackers. When performed consistently, a pen test process will inform your business where the weaknesses exist in your security model. The results of a pen test can also assist your business with improved planning when it comes to business continuity and disaster recovery.

The process involved with Network Penetration Testing

Black Box

A penetration test that is black box is conducted without the knowledge of any information related to the technical aspects of a network.  This type of test requires penetration testers to conduct comprehensive network exploration in an effort to determine the best way to organize a simulated attack. Black box penetration testing is a simulation of a more realistic exploit on a network.  This method is used by businesses that want to stay on top of what hackers are capable of doing within a very short period of time.

White Box

White Box penetration testing occurs when network professionals have gathered all data and information associated with a network and its architecture.  This type of pen test is more like an audit and provides a comprehensive approach to security testing.  This form of pen testing is used by businesses that want to ensure every single aspect of their network is as secure as possible.

Grey Box

The Grey Box approach to penetration testing is performed according to internal information for a network including technical documents, user privilege credentials, and more.  Based on the internal information collected, a highly sophisticated network attack can be launched to determine what can happen when hackers gain access to sensitive information. Grey Box pen tests are a common approach that provides detailed security testing that takes place over a shorter period of time than the more involved process of White Box pen tests.

The Tool used: OWASP ZAP

            The OWASP Zed Attack Proxy (ZAP) is one of the world’s most popular free security tools and is actively maintained by hundreds of international volunteers. It can help automatically find security vulnerabilities in web applications while you are developing and testing applications. It is also a great tool for experienced pen testers to use for manual security testing.