What is penetration testing?

Penetration testing, or pentesting, is an authorised, simulated attack on a system to find out which weaknesses an attacker could actually use and how far they could get. Unlike a scan, a pentest tries to exploit and chain findings, within a written scope, and reports each one with evidence and a fix.

Why it matters

NIST describes penetration testing as security testing in which evaluators mimic real-world attacks to identify ways to circumvent the security features of an application, system or network. The value is in that mimicry: a scanner lists possible issues, while a tester checks which of them are real, which combine into something worse, and which business-logic flaws no signature would catch.

NIST SP 800-115 lays out the phases most methodologies share: planning, where scope and rules of engagement are agreed in writing; discovery, which is reconnaissance and attack surface mapping; attack, where findings are verified; and reporting. The OWASP Web Security Testing Guide breaks the web part into concrete tests per area, from information gathering to authorization and input validation.

Example: a first pentest plan for your own site

Before any request, write the scope down, even when the site is yours: which hosts, which accounts, what is off limits, when testing happens. Then work through the phases on https://your-app.example, or on CyberGym if you want a target built for practice:

Scope:     your-app.example, api.your-app.example (production read-only, staging full)
Accounts:  test-user-a, test-user-b, test-admin (created for testing)
Excluded:  payment provider, email sending, denial of service

1. Discover   map pages, logins, API endpoints and the auth each requires
2. Test       per endpoint: access control across users, input handling, errors
3. Verify     reproduce each finding, note the exact request and response
4. Report     finding, evidence, impact, fix; then retest after the fix

A pentest's result is a list of findings, each with evidence; it is not a certificate. A clean report means these tests, in this scope, at this time, found nothing, which is useful to know and is not the same as being secure. Run it again after significant changes.

Common mistakes

  • Calling a scan a pentest. An automated scan is a useful input. A pentest verifies, chains and explains what the scan only suggests.
  • Testing without written permission. Even on a site you manage, hosting providers and third-party services may need notice. Never test a site you do not own or have permission for.
  • Testing production writes blindly. Use test accounts and staging for anything that creates, changes or deletes data.
  • Never retesting. A fix is not done until the original request fails. Retest each finding.

Related terms

Go deeper

Sources

Test only sites you own or have written permission to test. To practise without one, use CyberGym, a legal, deliberately vulnerable target. Practise on CyberGym.