A Study on Penetration Testing Process and Tools
Hessa Mohammed Zaher Al Shebli (NYIT, Abu Dhabi, UAE), Babak D. Beheshti, PhD (NYIT, Old Westbury,
New York)
Abstract: Information is more vulnerable than ever; and every technological advance raises new security
threat that requires new security solutions. Penetration testing is conducted to evaluate the security of an
IT infrastructure by safely exposing its vulnerabilities. It also helps in assessing the efficiency of the defense
mechanisms tools and policy in place. The Penetration testing is conducted regularly to identify risks and
manage them to achieve higher security standards. In this paper we discuss the importance of penetration
testing, factors and components considered while conducting a penetration test, we present a survey of
tools and procedures followed, role of penetration test while implementing in the IT governance in an
organisation and finally the professional ethics to be possessed by the team involved in penetration test.
Keywords: IT security, penetration test, IT governance, vulnerability assessment, ethics for professional
hacking
1. Introduction: This paper includes a brief overview of PEN
Testing, benefits of conducting a PEN test, the
Data and information security is in the top priority process and tools available for performing a PEN
list for companies these days. All Businesses test. It also discusses the vulnerability
need to protect its information's to build a assessment, penetration test in IT security
competitive advantage. Information are protected standards like ISO 27000 and personal &
using standard process and well documented professional ethics of the person involved in the
structured methods. It is also ensured that they penetration testing process.
follow security standards and regulations. Some
of the regulations process include security 2. PEN test benefits
assurance process, software engineering
environment for security, proof of correctness and A penetration test is used to identify the risks that
penetration tests. may occur when an attacker get access to the
organization’s computing system and networks.
Penetration testing (aka PEN test) is a structured Performing a PEN test will help estimate the
process to test an organization computing base mitigation plan to close security gaps before the
which includes hardware, software and people. actual attack happens. Conducting a PEN test
This process includes an analysis of the entire helps organizations to reduce financial and
organizations’ computing system looking for information loss that would have caused loss in
vulnerabilities like system configuration, software customer trust due to security breaches.
and hardware errors, and its operational process
in order to identify the weakness. It safeguards the organizations against failure
through preventing financial loss and provide
A security test helps to ensure the behavior of the compliance to industry regulators, customers and
system security control, whereas a PEN test shareholders; helping to develop trust, corporate
helps to determine the level of difficulty for an image, and rationalize IT security investments. As
attacker to penetrate into an organization penetration testing is a proactive process, it
computing network. In a PEN test an provides unassailable information that helps the
unauthorized attack is demonstrated by a user on organization to meet the auditing or compliance
the test target system using automatic aspects of regulations [1].
programmed tools, manual tools or both.
One of the main objectives of PEN testing is to
create IT security and its importance at all levels
in an organization through structured training and possibilities for security breaches are identified
awareness programs in order to avoid security from scratch.
incidents that may cause damage in terms of
confidentiality, integrity, relationship and In a white box penetration testing, the testers are
customer trust. given all the information about the test target.
A PEN test helps organization to evaluate the Gray box penetration testing, the testers are
level of security awareness among its employees, provided with partial information about the tested
effectiveness of the existing security policy and target and the rest are for identification.
process and also the efficiency of its products. It 3.1. External testing
helps in decision making process to evaluate the
organizations security and hence plan for the External testing is to perform an attack from
security investment and IT strategy. outside the organization on the tested target. It
helps to identify how, if an outside attacker gets
Penetration testing also helps in shaping the in to the network and how far he can get access
important aspects of information security strategy once taking controls.
by identifying the vulnerabilities quickly and
accurately. It also supports in improving test 3.2. Internal testing
configurations to proactively eliminate identified In the internal testing, an attack is performed on
risks. It helps business to evaluate the impacts the organization computing network as an
and likelihood of the vulnerabilities. Hence the internal user having standard access privileges.
organization can priorities and implement the By doing internal testing, the tester can estimate
mitigation action plan for the vulnerabilities the damages that may be caused by unhappy
identified. Penetration testing consumes lots of employee in the organization. In this process the
time, efforts and knowledge depending on the test target is tested by penetrating a system and
complexity of the business. Therefore, identifying the causalities as a user having
penetration testing supports the enhancement of standard access privileges.
the knowledge and competency of the persons
involved in the process. It is considered as a 3.3. Router Penetration
quality assurance tool that benefits both business Router Penetration is testing the misconfiguration
and operations. of router for specific vulnerabilities. Routing
devices are used to direct network traffic, and if
3. Penetration testing strategies
one router is misconfigured it can be used to
manipulate network traffic. A compromise on
There are three methods of penetration testing
routing device compromises the entire network
methods, based on the information available:
traffic.
black box, white box and gray box [1].
3.4. Firewall Penetration
Firewall Penetration is to perform an attempt to
penetrate the firewall and host on the test target
to look for vulnerabilities across the firewall
security software, configuration settings and
operating system itself. The results will help to
identify the misconfigurations and eliminate
poorly implemented security policies in the
organization.
3.5. Application Penetration
Figure 1: Penetration testing methods
Application Penetration is to perform
In the black box penetration testing, the team has conscientious testing of an applications to check
no information about the tested target. The for code related or back end vulnerabilities that
provided access to the application itself, the
underlying operating system, or the data that the management level in the organization. The
application can access. organizations employ Penetration testing is conducted in three phases
experts to perform application penetration and [2]:
security assessment testing online trade portals
or other applications like games, antivirus and 1. Test preparation.
embedded applications. 2. Test implementation.
Intrusion Detection System 3. Test analysis.
Intrusion Detection System Penetration is to
attempts and penetrate IDS from outside as well
as inside to find loop holes due to weak security
policies. Though it is unlikely to have complete
information on the rule set of existing IDS, many
hackers and security consultants do understand
the common IDS rule set, including typical
threshold values. They develop their penetration
strategy around bypassing the common IDS
configuration. The test should help to identify
holes in IDS rules, signatures or thresholds to
avoid IDS.
3.6. Password Cracking Penetration
Password Cracking Penetration is to extract Figure 2: Phases of penetration test
password and shadow files in Linux or extract 4.1. Test preparation
SAM files in windows and use cracking tools.
Some of the passwords cracking tools are john In test preparation the documents are collected
the ripper, pwdump3, l0phtcrack. The process is and finalized. In this phase the scope of the
to identify the target person’s personal profile and system components, objective of the test, test
try various password cracking tools to break duration and time are identified, agreed and
password protected files. Then the password documented. Predicted incidents like information
cracking team makes a report and presents it to leakage, downtime is also identified and are
the organization. documented in the legal documents and are
agreed and signed by both sides.
3.7. Social engineering
4.2. Test implementation
Social engineering is a term used to describe an
attack that relies entirely in human error. It This phase involves the following steps:
gathers valuable and sensitive information • information gathering.
through the use of psychological manipulation to
trick legitimate users. This kind of attack is very • vulnerability analysis.
dangerous since users’ mistakes are less • vulnerability exploits.
predictable.
PEN testing helps the organization evaluate their During the information gathering step it is
staff adherence to the organizations’ policies and required to scan and identify all logical and
procedures. It also helps in improving the security physical areas and all possible information
training provided for the employees. required for the analysis of vulnerability analysis.
Depending on the information collected, the
PEN test process tester, analysis and assess the vulnerabilities
To conduct a penetration test and document its exists [4]. The test can be conducted using
outcome it needs a systematic approach which automated testing tools or manual testing tools or
are circulated to different organization units and both sometimes.
In the vulnerability assessment step, the
penetration tester will receive the challenge to
evaluate and find the necessary security defeats
from the target. This task requires complete
attention in process of the penetration testing. It
is very important to ensure that each task,
functions, and processes followed in specific and
proper way step by step. In the proposed model
of penetration testing this phase expands in two
main procedures: Code Analysis and
Vulnerability Analysis
Code Analysis is used to find security flaws by
analyzing source code. Usually analysis like this
would automatically find security flaws with a high
degree.
This vulnerability analysis is divided into two
areas. Identifying and reducing the number of
new vulnerabilities before the software is
deployed. With vulnerability discovery, it strives
to help engineers understand how vulnerabilities
are created and found. Main goal is that, with this
education, engineers will learn how to detect and
eliminate and eventually avoid vulnerabilities in
software products before the products are Figure 3: Logical model of a penetration test process
shipped. The unfortunate reality is that many
software products are being shipped with This vulnerability remediation process involves a
vulnerabilities that attackers may be able to comprehensive approach to protecting systems
exploit [3]. using below equation
Total Vulnerability = (CA + VA)
Where CA =Code Analysis and
VA=Vulnerability Analysis.
In the last step the tester exploits for the
vulnerabilities found in the vulnerability analysis
step. Exploitation is the process to gain access by
taking advantage of vulnerabilities which
received previously through analysis phase.
Generally, this phase performs if client is
agreeing to evaluate impact of risks due to
existing vulnerability because this phase contains
high risk and may damage the targeted system.
However, using this task penetration tester can
evaluate the perfect solutions and impacts of
existing vulnerability. An exploit is a set of
commands that takes advantage of vulnerability
and may cause unintended behavior to software,
hardware, or something electronic. This include
privilege escalation, DoS denial of service attacks
and gaining control to restricted parts. Sometimes
exploits when investigated do not results to what 4. Tools for penetration testing
it was intended and hence may require more
analysis, which is usually feedback process or There are a wide variety of tools that are used in
self learning process between vulnerability Penetration Testing and the important tools are
analysis and exploits. [3]:
4.3. Test analysis. 5.1. NMap
Reporting, when penetration testing process has NMap is also called Network Mapper In order to
been compiled at same time the next process is develop network services and maps, NMap
to provide advisory and various reports to senior sends specifically crafted packets to the target
management through reporting process, IT host and then analyses the responses. NMap
management and IT technical staff will all likely supports the scanning of the various types of
see the report, or at least part of it. The report has protocols and most of the existing systems.
sections: core Summary, Technical detail,
assessment Findings, Risk Level indication 5.2. BeEF
overview, Patch information advisory, Budget BeEF is stands for The Browser Exploitation
information and Time Estimation etc... Using this Framework focuses on the web browser. It works
report penetration tester can represent the entire on Linux, Apple Mac OS X and Microsoft
process to the IT management so that the final Windows. BeEF allows the professional
solution can be obtain and implement. A penetration tester to assess the actual security
mitigation plan is prepared after the penetration posture of a target environment. It investigates
testing. the exploitability in the context of web browsers.
Advisory, the final phase of penetration model 5.3. Metasploit
includes security solution and patched
Metasploit is test tools that test for weaknesses in
information against all found risks such as
operating systems and applications. This
Preparation of Countermeasures, Budget
penetration testing tool is based on the concept
Estimation, Time Estimation, Creating Advisory
of ‘exploit’. It runs a set of code on the test target
Map, Discussion with the Client, Recheck the
creating framework for penetration testing. It
implemented Solution etc… this is the task where
works on Linux, Apple Mac OS X and Microsoft
penetration tester must give definitive and
Windows [3].
conclusive advisory report for various solutions
and the cost. In many instances when the 5.4. Nessus
penetration testing is completed, it is essential for
the client to install the suitable patches. In such Nessus is a penetration testing tool and remote
cases, security solution should be provided in security scanner, typically run on one machine to
both open source and paid solutions. The scan the services offered by a remote machine.
advisory phase is dependent on reporting phase Nessus is the world’s most popular vulnerability
because advisory must be prepared after scanner that is used in over 75,000 organizations
complete review of all different reports. Advisory worldwide. This tool allows the user to script and
mainly direct to include three major components run specific vulnerability checks. These checks
to install. provide a lot of control where most products do
not.
1. Advice to install the patch if available
2. Advise to install the open source patch if 5.5. Cain and Abel
available Cain and Abel mostly used for password
3. Advise to install paid patches and software cracking. It uses network sniffing, Dictionary
attack, Brute-Force and Crypt analysis attacks,
and routing protocol analysis methods to
accomplish this. This is entirely for Microsoft
operating systems.
5. Information Security Management 6. Professional Standards and Ethical
System (ISMS) Competency
Information Security Management System Penetration testing is effective when it is a team
(ISMS) which specifies the requirements for the of professionals, where all have their roles and
implementation of security controls customized to responsibilities appointed and everyone what
the needs of organizations to minimize assets must done and how [9]. While conducting a
risks and ensure business continuity [6]. The penetration test on a system or protocol, there are
ISMS is designed to protect the information several ethical and competency issues faced by
assets from any security breaches. ISO27k is a the person involved. Explicitly including or
series of international standards for Information significant omission could possibly be dangerous
security management. This standard covers all to the organisation [6]. Always the tester
types of organizations: commercial business, employees is ethically and legally complied to
government agencies and non-profit meet the customers requirement and hence
organizations, all sizes from micro-businesses to ensure that these test do not lead false or
multinational business. misleading issues.
The services taken into consideration are (C-I-A) There are Code of Conduct and Best Practice laid
traits: by professional bodies, but while conducting the
test the individual is often required to take an
• Information Confidentiality, informed decision and hence should possess the
• Information Integrity necessary procedural, ethical and technical
training such as:
• Service availability.
• IEEE, 2010
Information Security Management System is
• IEEE Computer Society IEEE CS
based on the PDCA model also known as Plan
Do Check and Act model, which is applied to • BCS British Computer Society
structure its processes.
• BCS - The Chartered Institute for IT, 2010
• BCS Information Security Specialist Group
BCS-ISSG
• Institute of Information Security Professionals
(iisp)
7. Professional Standards and Technical
Competency
Professional bodies set industrial standards to
distinguish members and non-members. It is
called code of conducts and mark as a guide to
the penetration tester.
The common codes of conducts are:
Figure 4: Plan-Do-Check-Act (PDCA) model
• EC Council or EC Council, 2010
The results of the tests will help to identify
• ISC2 code of ethics of The ISC 2 code of
weaknesses within information security and
provide information on how these weaknesses ethics
can be penetrated by an attack [2]. These can
then be used as part of the risk assessment and All testers and personals involved in the PEN test
steps implemented to enable remedial action. have to keep up their knowledge and update on
the tests and development. It is important to
constantly develop skills and understanding of Journal of Computer Applications, vol. 59, no.
new system that are being developed and used. 5, p. ISSN: 0975 – 8887, 2012.
OSSTMM Open Source Security Testing [4] K. ,. K. K. Ankita Gupta, "Vulnerability
Methodology Manual are used in developing Assessment and Penetration Testing,"
technical skills and knowledge. International Journal of Engineering Trends and
Technology-, vol. 4, no. 3, 2014.
OWASP Open Web Application Security Project
[5] G. K. Gurline Kaur, "Penetration Testing:
are used for internet based applications
Attacking Oneself to Enhance Security,"
International Journal of Advanced Research in
8. Conclusion Computer and Communication Engineering ,
vol. 5, no. 4, pp. ISSN: 2278-1021 , 2016.
In this paper, we have discussed penetration test,
factors to be considered while performing [6] M. Z. H. M. T. A. C. Muhammad Zunnurain
penetration test, the process of conducting Hussain, "Penetration Testing In System
penetration test, commonly used tools and Administration," INTERNATIONAL JOURNAL
software for conducting a penetration test. The OF SCIENTIFIC & TECHNOLOGY
RESEARCH, vol. 6, no. 6, pp. ISSN 2277-8616,
process becomes effective if the actions are
2017.
taken to solve the vulnerabilities identified.
Finally, is comes to the organisational process [7] A. B. a. T. M. William Knowles, "Analysis and
and personal ethics in managing the risk and recommendations for standardization in
vulnerabilities. Hence in this paper we have also penetration testing and vulnerability
discussed the role of the Information Security assessment," BSI group, London, 2014.
Management System (ISMS), professional
Ethical and technical Competency required for [8] S. S. M. A.-J. R. Q. F. M. a. F. D. Awni Itradat,
performing the penetration test. "Developing an ISO27001 Information Security
Management System for an Educational
Institute: Hashemite University as a Case
9. References Study," Jordan Journal of Mechanical and
Industrial Engineering , vol. 8, no. 2, pp. 102-
108, 2014.
[1] X. Y. B.-T. B. C. M. J. Aileen G. Bacudio, "AN
OVERVIEW OF PENETRATION TESTING," [9] J. M. a. C. I. S. Faily, "Ethical Dilemmas and
International Journal of Network Security & Its Dimensions in Penetration Testing," in
Applications (IJNSA), vol. 3, no. 6, 2011. Proceedings of the Ninth International
Symposium on Human Aspects of Information
[2] V. S. KUMAR, "Ethical Hacking and Penetration Security & Assurance (HAISA 2015) , London,
Testing Strategies," International Journal of 2015.
Emerging Technology in Computer Science &
Electronics (IJETCSE), vol. 11, no. 2, pp. ISSN [10] A. G. J. a. M. J. W. Justin D. Pierce,
0976-1353, 2014. "PENETRATION TESTING PROFESSIONAL
ETHICS: A CONCEPTUAL MODEL AND
[3] P. Ami and A. Hasan, "Seven Phrase TAXONOMY," Australasian Journal of
Penetration Testing Model," International Information Systems, vol. 13, no. 2, 2006.
