A Guessing Game

Picture this – Halloween in the ’80s. A classroom full of students at their desks, staring at a large object hidden under a blanket. The guessing game had only just begun. Gasps filled the room as our teacher revealed a gigantic pumpkin. “If you guess how much it weighs, it’s yours!” Our teacher was encouraging a creative lesson on estimation.

The only thing keeping that pumpkin from being carved and glowing on my front porch was my correct estimation of its weight. Some of my peers jotted down their answers without a second thought, and others stared at the ceiling in boredom, but those that were crafty compared with objects that were similar in size. So that is just what I did.

Comparing Vulnerabilities from Past Projects

The process of penetration testing is often the same.

Penetration testers are expected to find the unseen cracks in an organization’s security. Just as the pumpkin from the story had an unknown weight, client environments have undiscovered vulnerabilities. When an organization undergoes a penetration test, they expect the hired tester to discover all their neglected vulnerabilities within the limited amount of time in the engagement. Because of this, penetration testers can often compare tests to those they have done in the past. If they have observed one organization make a mistake, they will see a similar vulnerability hidden in another.

For example, when I examine a web application and find an area for file uploads, I immediately reference past projects where I succeeded in compromising a similar vulnerability. In a recent penetration test, I noticed that the web application contained an area in a note for embedding HTML code. Referencing a previous test, I began writing a new note with HTML tags and JavaScript code to test for Cross-Site Scripting. Sure enough, the application was vulnerable to Stored Cross-Site Scripting.

You Need Experienced Penetration Testers

Experience is what makes penetration testers experts that can make educated comparisons and conduct advanced testing. Without past projects to reference, inexperienced penetration testers are just playing a guessing game. At KirkpatrickPrice, our team has an average of fifteen years in the industry. You can count on our penetration testers to make the most of the time restraints and discover your most vulnerable gaps.

As for the pumpkin contest, I did win. The correct guess was 75.5 pounds, and I put down 75. When my teacher asked how I came to that estimation, I merely answered: “The pumpkin looked about the size of my sister.”

Who knew that I would spend the rest of my life playing a similar game of comparison.

Man working on computer

What is Penetration Testing?

Penetration testing is a form of permission-based ethical hacking in which a certified penetration tester attempts to gain access to an organization’s system, network, or web application(s). The purpose of penetration testing is to find vulnerabilities that could potentially be exploited by a malicious hacker as part of a routine security check. This form of security testing allows organizations to find the vulnerabilities in their security infrastructure before someone else does. If you’re new to penetration testing, you’ll need to determine which type of penetration testing is best for your organization.

Types of Penetration Testing

There are a few different types of penetration testing. The type of testing you choose will depend upon what threats you’re trying to eliminate and what level of security testing you wish to have performed.

Web Application Penetration Testing: Web application pen tests evaluate the security of websites, web application, thick clients, etc. The process involves an active analysis, by a GIAC Certified Web Application Penetration Tester (GWAPT), of the application for any weaknesses, technical flaws, or vulnerabilities.

External Network Penetration Testing: An External Network Penetration test helps determine the security of external systems such as routers, firewalls, public-facing servers, etc. from a remote hacker. An external network pen test is performed by a GIAC Certified Penetration Tester (GPEN) who attempts to gain access to sensitive data by exploiting known vulnerabilities, clients, and people via social engineering.

Internal Network Penetration Testing: Internal Network Penetration testing is a simulation of an insider attack who has authorized access or is working from inside the firewall. The target of the attack would be the same as an external test, but an internal would emulate a terminated or disgruntled employee working within the internal network. The purpose of this type of pen test is to find what vulnerabilities exist for systems that are accessible to authorized internal network connections.

Vulnerability Scanning: Vulnerability scanning is a technique used to identify security weaknesses and vulnerabilities in a computer system. By using a commonly available tool to evaluate system configurations against a database of over 80,000 known vulnerabilities, this type of scanning can help identify areas that need remediation.

Social Engineering: The weakest point in an organization’s security posture is its people. Social engineering is a form of attack that depends heavily on human interaction and the manipulation of people to acquire confidential information such as usernames and passwords and other confidential information.