Penetration Testing
A scoped, authorised assessment that answers one question: what could someone actually do?
What A Test Is For
A vulnerability scan lists what might be wrong. A penetration test establishes what an attacker could actually achieve — by chaining findings, using real credentials, and pushing until something meaningful is reachable or the scope ends.
| Activity | Answers | Depth |
|---|---|---|
| Vulnerability scan | What known issues exist | Automated breadth |
| Penetration test | What an attacker could reach | Manual, scoped, time-boxed |
| Red team exercise | Whether the defenders would notice | Objective-based, stealthy |
| Bug bounty | What the internet finds over time | Continuous, unpredictable |
Rules Of Engagement
The paperwork is the profession. The rules of engagement define what is in scope, what is forbidden, when testing may happen, and who to call when something breaks.
| Clause | Why it exists |
|---|---|
| In-scope systems and addresses | Prevents testing a shared host you do not own |
| Explicitly out of scope | Production payments, medical devices, third-party services |
| Testing window | Avoids the busiest hours and the peak trading day |
| Prohibited techniques | Usually denial of service and social engineering unless agreed |
| Emergency contact | Someone reachable the moment something goes wrong |
| Data handling | What may be accessed, and how evidence is stored and destroyed |
| Get-out-of-jail letter | Written authorisation the tester can produce on demand |
The Methodology
Established methodologies — OWASP's testing guide, PTES, NIST 800-115 — differ in detail and agree on the shape.
| Phase | Goal |
|---|---|
| Scoping and authorisation | Agree targets, limits, dates and contacts |
| Reconnaissance | Map the estate and its technologies |
| Analysis and discovery | Identify weaknesses worth investigating |
| Verification | Confirm exploitability — carefully, within scope |
| Post-exploitation assessment | What would this access actually reach |
| Reporting | Findings, evidence, severity, remediation |
| Retest | Confirm the fixes actually fixed it |
The phase people underestimate is the last two. A test that ends without a clear report and a retest has produced a document, not an improvement.
The Report Is The Product
Clients pay for the report. It has two audiences and must serve both: an executive summary that states business risk in plain language, and technical findings a developer can act on without a follow-up call.
| Section | Contains |
|---|---|
| Executive summary | What was tested, what the risk is, what to do first |
| Scope and methodology | What was covered — and what was not |
| Findings | Each with evidence, severity, affected assets and remediation |
| Attack narrative | How findings chained together into real impact |
| Remediation plan | Ordered by risk, with realistic effort estimates |
| Appendices | Raw output, tooling, timestamps |
Working In The Field
Penetration testing is a licensed-feeling profession without a single licence. Employers look for demonstrable methodology, clear writing, and evidence of legal, ethical practice.
| Build | How |
|---|---|
| Practical skills | Deliberately vulnerable labs and legal practice ranges |
| Competitive experience | Capture-the-flag events — legal, scoped, and well regarded |
| Credentials | Practical certifications with a hands-on exam carry the most weight |
| Writing | Reporting is half the job and the half most candidates neglect |
| Fundamentals | Networking, operating systems, web and cloud — tools change, these do not |
Interview Questions
Penetration test versus vulnerability scan?
A scan enumerates known issues automatically. A test is manual and scoped, chaining findings to establish what an attacker could actually reach and what the business impact would be.
What is in the rules of engagement?
In-scope and out-of-scope systems, the testing window, prohibited techniques, emergency contacts, data-handling rules and written authorisation the tester can produce on demand.
Black box or white box?
White box — source and credentials supplied — usually finds more real issues per day, because time goes into finding flaws rather than rediscovering the architecture. Black box better simulates an outsider.
How far should verification go in production?
Prove access is possible, then stop. Destroying or exfiltrating data is unnecessary to demonstrate risk and is outside almost every rules-of-engagement document.
What makes a good report?
An executive summary in business language, findings with evidence and specific remediation, an attack narrative showing how they chained, and an explicit statement of what was not tested.
Penetration test or red team?
A test finds as many exploitable weaknesses as possible in a scope. A red team pursues a specific objective stealthily, and is really a test of whether the defenders detect and respond.