Penetration testing is the process of testing the security controls of an organization with the intent to exploit weaknesses and gain access to the system. A scope and boundary are defined to prevent the assessor from access systems outside the system owner’s responsibility. The Pen tester usually has their own set of specialized tools used to find and exploit vulnerabilities, gain and keep privileged access, and avoid current and future detection by hiding their activities from network security mechanisms. Penetration testing is an exercise of the team of testers ability to circumvent security controls in place. The process is not to find all exploitable opportunities but to exploit the most likely ones to gain access. Penetration testing can be long and tedious given the difficulty of executing an exploit or if trying to avoid a multitude of intrusion detection systems during the test.

Our Penetration testing has 6 primary steps: Reconnaissance, Vulnerability Detection, Exploitation, Gaining Privileged Access, Keeping Access, and Covering your Tracks. The Penetration testing deliverable is a report of the exercises attempted and their results. It also should have a set of remediation recommendation to help close the exploits that were successful. Additionally, there should be documentation of unsuccessful results such as screenshots, tool outputs, text files, spreadsheets, and other forms of notes and results discovered. This provides the tester with repeatability and re-examination information that can reduce costs for future tests.