What Is Network Penetration Testing?
Penetration testing of network infrastructure involves simulated hacking attacks against the network to find out security loopholes that would otherwise be discovered by an attacker. In other words, it involves engaging ethical hackers to hack your network in order for you to patch the security issues identified.
What is often misunderstood is that penetration testing is not simply conducting a vulnerability test. Vulnerability testing informs you about potential weaknesses, but penetration testing involves exploiting such weaknesses and doing something that an attacker would do. Learn More
The Five Phases of Network Penetration Testing
Process comprehension is the primary step towards mastery of the process. Penetration testing conducted by professionals is done according to a methodological approach, and the generally accepted one is the Penetration Testing Execution Standard (PTES), consisting of seven phases. For convenience, let us consolidate them into five basic phases:
Phase 1: Planning and Scoping
You cannot do anything until you have planned everything. The plan includes:
- Goals: What are your objectives? Testing compliance (for PCI DSS, HIPAA, and ISO 27001) or verifying controls?
- Target Systems: What are your target systems? Websites, internal servers, and wireless networks?
- Rules of Engagement: When are the tests to be done, and what is out of bounds?
Tip: Always have written authorization to test; otherwise you commit an offense and do not do a security test.
Phase 2: Reconnaissance (Information Gathering)
This is the phase when testers become detectives and gather as much information as possible about the target network.
Open-Source Intelligence (OSINT): You would be surprised what kind of information you can get. Testers collect data from WHOIS lookup, DNS lookup, company websites, and social media.
Network Scanning: Testers use such tools as Nmap to detect live hosts, open ports, and services. A basic Nmap command to find live hosts in a subnet is as follows:
bash
nmap -v 192.168.56.0/24For a more detailed scan to identify hidden ports and services:
bash
nmap -v -p- 192.168.56.110Phase 3: Vulnerability Scanning
After identifying what is present on the network, the testers proceed to find any potential vulnerabilities. This process is conducted using automated scanners such as Nessus or OpenVAS that find Common Vulnerabilities and Exposures (CVEs).
But note: vulnerability scanning alone does not constitute penetration testing. These automated scanners give false positives. Testing begins in the next phase.
Phase 4: Exploitation
These are the activities that one imagines while thinking about hacking. The tester tries to make use of the vulnerabilities discovered through the scanning process. For instance, they:
- Access initially the vulnerable systems
- Try to escalate privileges
- Leverage to other systems within the network (lateral movement)
A tester may exploit the vsFTPd backdoor (CVE-2011-2523) and the Samba usermap script (CVE-2007-2447) vulnerabilities to get root access to a targeted system. They can then create a root account and get password hashes.
Phase 5: Post-Exploitation and Reporting
What occurs post-exploitation? This phase evaluates the impact an attacker can make. Is there any chance for exfiltration of sensitive data? Persistence?
The final report is by far the most important deliverable. An effective pentest report must speak to two audiences: the executive and the engineer.
Executive Summary: On a page, translate your findings into business speak. No longer will you state that there are three high-severity SQL injection findings; instead, you will state that “an attacker can steal all customer information without any authentication.”
Findings Section: Every vulnerability contains:
- Title in plain English
- Severity (CVSS score)
- Exploitation procedure
- Business consequence
- Remediation recommendation
External and Internal Penetration Testing
The ability to differentiate between the two will make the scope of your evaluation much clearer.
External Penetration Testing: Imitates an external penetration attempt by focusing on systems accessible from outside, such as websites, virtual private networks, and firewalls. It highlights any vulnerabilities in perimeter security.
Internal Penetration Testing: Implies that a hacker has some sort of internal access (an insider or hijacked system). Tests internal devices, user accounts, and shares for the presence of possible lateral movement.
Good Practice: Conduct both kinds of testing at least once per year.
Essential Tools for Network Penetration Testing
Here are the core tools used by professionals:
| Tools | Purpose |
| Nmap | Network scanning and service detection |
| Metasploit | Exploit development and execution framework |
| Wireshark | Traffic analysis and packet inspection |
| Nessus | Automated vulnerability scanning |
| Burp Suite | Web application penetration testing |
| John the Ripper | Password hash cracking |
| Hydra | Password brute-force testing |
For Beginners: This is because most of the above tools are already pre-installed in the Kali Linux distribution. Since it is designed for ethical hacking and penetration testing, it is the ideal choice for lab development.
Setting Up a Safe Lab Environment
When you’re studying, under no circumstances can you conduct any experiments on real networks without permission. The proper way to do it:
- Install VirtualBox, which is free software
- Create Kali Linux as your attacker’s machine
- Create your vulnerable target machine, for example, Metasploitable 2
- Both machines should be isolated from the rest of the network.
In this way, you will be able to mess around and restore everything back to normal.
Industry Standards & Frameworks
The methodologies followed by professional penetration testers include:
- PTES (Penetration Testing Execution Standard): A seven stage methodology, which includes all the steps from planning to report
- NIST SP 800-115: Information Security Testing Technical Guide
- OWASP Testing Guide: Important for testing web applications and APIs
- OSSTMM: Includes operational security testing with the inclusion of human and physical components
The Importance of Professional Penetration Testing
Why do companies conduct penetration testing? Take the following example. A large international financial corporation conducted regular internal penetration testing. During this testing, penetration testers identified a vulnerability on an unpatched Windows server and gained access to client information. The corporation was able to prevent a disastrous data breach and improve its patch management process. Penetration testing identifies hidden risks before malicious hackers capitalize on them.
Conclusion
Network penetration testing is the practice of trying to think like an attacker for the purpose of being able to defend yourself against said attacker. From beginner Kali Linux virtual machines to enterprise-wide assessment, it’s all about preparation, methodology, documentation, and permission above all else.
One last tip: the most valuable penetration test report is the one that is read and acted upon. Make sure your executive summary is free from jargon, your technical findings are thorough and replicable, and your recommendations for remediation are realistic. Learn More
Explore Our Cybersecurity Category. And if you are reading it up to here, leave a sweet comment to motivate us to write blog everyday.
