Penetration Testing Fundamentals
Penetration Testing Fundamentals
This domain tests precise definitions, engagement classification, recognized standards, and legal/ethical boundaries. You must distinguish a penetration test from a vulnerability assessment and explain why authorization and objectives shape every later decision.
Core rules
- A penetration test is an authorized, goal-oriented simulation of adversarial activity that validates exploitable weaknesses and business impact. A vulnerability assessment identifies and lists weaknesses, usually without exploitation.
- Knowledge models: black-box (no internal information), gray-box (partial information such as credentials), white-box (full information, source or configuration access).
- Target models: network, web, mobile, wireless, social engineering, physical, cloud, and objective-based red teaming. Red teaming also tests detection and response.
- Anchor methods to recognized sources: NIST SP 800-115 (planning, discovery, attack, reporting), PTES (seven phases, pre-engagement through reporting), OSSTMM, OWASP WSTG for web, and MITRE ATT&CK for adversary mapping.
- Written authorization must name targets, windows, permitted and prohibited techniques, emergency contacts, and data handling. Unauthorized testing can breach laws such as the U.S. CFAA or the UK Computer Misuse Act.
Worked example
A SaaS provider asks you to 'test the platform' with no detail. You do not scan first. You establish the objective: compliance-driven external test, pre-release application assessment, or detection validation? That determines black-box external, gray-box web with test accounts, or objective-based red team. You then confirm authorization from the provider and any hosting provider, define domains and accounts, and agree stop conditions and data handling. The same target produces three different engagements with different evidence and cost.
Traps
Treating a scan as a penetration test; accepting oral scope; testing third-party infrastructure without permission; equating 'no findings' with 'no risk'; and citing compliance as the only objective.