Cyber Security
Penetration Testing
Planning and running authorised security tests and reporting the results.
- 6 notes
- 49 minutes of reading
- Types of penetration test, from black box to red teamingThe different kinds of penetration test: black, grey and white box knowledge levels, target types such as external, internal, web, wireless and social engineering, and how red teaming differs. 7 min · Beginner
- Penetration testing methodologies: PTES, OWASP WSTG and NIST SP 800-115Why penetration testers follow a methodology, the main published ones (PTES, OWASP WSTG, NIST SP 800-115, OSSTMM) and how their phases fit together into a consistent engagement. 8 min · Intermediate
- Planning and scoping a penetration testHow to plan a penetration test properly: setting objectives, defining scope and exclusions, rules of engagement, contacts and stop procedures, third-party permissions and the legal paperwork. 8 min · Intermediate
- Web application testing: what testers check and how to fix itAn overview of how authorised web application tests are carried out, the main areas examined, typical findings in each, and how development teams should fix and prevent them. 9 min · Intermediate
- Internal and external network testing: findings and fixesWhat internal and external network penetration tests examine, the most common findings in each, and the practical fixes defenders apply to close them. 9 min · Intermediate
- Writing a penetration test reportHow to write a penetration test report that gets results: the executive summary, scope and method, well-structured findings with risk ratings and evidence, practical remediation and retesting. 8 min · Intermediate