Cybersecurity Roadmap

Learn how to secure networks, applications, and systems against digital threats.

Overall Progress0%

Penetration Testing

Explanation

Penetration testing is the authorized, controlled simulation of an attack against a system to find weaknesses before a real attacker does. It is not hacking for its own sake: it is a professional engagement governed by a signed authorization and a defined scope, and its output is a report that tells the organization what is broken and how to fix it. This lesson teaches the discipline: how a penetration test differs from a vulnerability assessment, the rules of engagement, the testing lifecycle, the different box types and testing surfaces, how findings are rated and reported, and the ethics that keep the whole activity safe and legal. Everything here is conceptual, controlled, and defensive. You will reason about scope, findings, and remediation — never about exploiting a real target.

Vulnerability Assessment vs Penetration Testing

	Vulnerability Assessment	Penetration Testing
Goal	Find and list weaknesses	Prove what an attacker could actually do
Depth	Broad, mostly automated	Deeper, manual, goal-driven
Exploitation	Not performed	Controlled exploitation of validated findings
Output	Inventory of vulnerabilities	Findings with impact and remediation

A vulnerability assessment finds; a penetration test proves. They are complementary: many engagements start with an assessment and follow with targeted testing.

Rules of Engagement, Authorization, and Scope

Authorization: written permission signed by someone who can grant it.
Scope: the exact systems, networks, and techniques allowed.
Rules of engagement: what the tester may and may not do.
Time window: when testing may occur.
Emergency contact: who to call if something breaks.

The Penetration Testing Lifecycle

Scoping

↓

Reconnaissance

↓

Enumeration

↓

Vulnerability Identification

↓

Exploitation

↓

Post-Exploitation

↓

Reporting

↓

Remediation & Retesting

The lifecycle is methodical: understand the target, find entry points, validate them, document everything, and help the organization fix what was found.

Box Types: Black, White, and Gray

Type	Tester knowledge	Best for
Black-box	No prior information	Simulating an external attacker
White-box	Full information (code, configs)	Finding the most issues efficiently
Gray-box	Partial information	Balanced, realistic testing

Internal vs External Testing

External: from the internet, simulating an outside attacker.
Internal: from inside the network, simulating a malicious insider or compromised host.
Internal tests reveal what an attacker can reach after getting inside.

Reconnaissance and Enumeration

Reconnaissance: passively gathering information (DNS, metadata, public sources).
Enumeration: actively discovering hosts, services, and accounts.
Both build a map of the attack surface within scope.

Vulnerability Identification

Compare discovered services and versions against known weaknesses.
Probe for misconfigurations and missing patches.
Prioritize findings by likelihood and impact before exploiting.

Exploitation and Privilege Escalation (Concept)

Exploitation proves a vulnerability is real and measures its impact.
Privilege escalation moves from limited to higher access.
Every step is documented so the impact can be reproduced and fixed.

Post-Exploitation and Evidence

Determine what an attacker who reached this point could access.
Collect screenshots, logs, and steps as evidence.
Document the full path so defenders understand the chain.

Common Tools (Conceptual)

Tool	Purpose
Nmap	Network discovery and port/service enumeration
Burp Suite	Web application testing and request interception
OWASP ZAP	Web application security scanning
Metasploit	Framework for validating known vulnerabilities

Tools support the methodology; they do not replace it. A tester reasons, plans, and documents — tools only execute parts of that plan.

Finding Severity and CVSS

CVSS (Common Vulnerability Scoring System) rates severity with a 0–10 score.
Severity reflects exploitability and impact, not just the vulnerability class.
Ratings help the organization prioritize remediation.

Reporting: Executive vs Technical

	Executive Report	Technical Report
Audience	Leadership	Engineers and admins
Content	Risk, impact, priorities	Steps, evidence, technical detail
Length	Short, business-focused	Detailed and complete
Purpose	Decision-making	Remediation

Remediation and Retesting

Each finding maps to a concrete fix.
Remediation is prioritized by severity and business impact.
Retesting confirms the fix actually closed the issue.

Professional Ethics

Act only within the authorized scope.
Handle discovered data with confidentiality.
Report findings honestly without exaggeration.
Do no harm: testing must not disrupt real operations.

Examples

A controlled engagement

A company authorizes an external black-box test of one web application.

text

1Scope: webapp.example.test (staging, no production)2Allowed: recon, enumeration, vulnerability validation, reporting3Prohibited: production systems, denial of service, data exfiltration4Window: Saturday 00:00–06:00 UTC5Emergency contact: security-lead@example.test

Output

(a clear scope and rules of engagement)

A finding write-up

A validated finding with severity and remediation.

text

1Title: Missing authorization on invoice API2Severity: High (CVSS 8.1)3Finding: /invoice/{id} returns any invoice without an ownership check4Impact: any authenticated user can read others’ invoices5Remediation: enforce object-level authorization on the server

Output

(what, why, impact, and fix in one place)

Key Takeaways

Penetration testing is authorized, scoped, and evidence-driven.
Authorization and rules of engagement are legal boundaries.
The lifecycle runs from scoping through reporting and retesting.
An assessment finds; a penetration test proves impact.
Findings are rated (CVSS) and reported to both executives and engineers.
Remediation and retesting close the loop.

← PreviousSecure Coding & SAST Next →Malware Analysis