Penetration Testing

A penetration test, or pentest, is a controlled attack. A security professional, often called an ethical hacker or red teamer, is given written permission to break into a target the same way a criminal would. The difference is the rules of engagement: there is a signed scope, a time window, and an agreement on what is off-limits. When the test ends, the tester hands over a report instead of stealing data.

Pentesting is different from a vulnerability scan. A scanner like Nessus or Qualys lists weaknesses it thinks exist. A pentester proves which ones are real by chaining them together into a working exploit. A scanner might flag an outdated library; a pentester uses that library to get a shell, pivot to the database, and dump customer records, showing the true blast radius.

Tests come in three flavors based on how much the tester knows up front. Black box means they start with nothing but a domain name, mimicking an outside attacker. White box gives them source code, credentials, and architecture diagrams for a deep review. Gray box sits in the middle, often simulating a logged-in user or a compromised contractor.

Most engagements follow a repeatable cycle. First comes reconnaissance, where the tester gathers public data: subdomains, exposed S3 buckets, employee emails, leaked credentials, and open ports found with tools like nmap. Then comes scanning and enumeration to map services, versions, and likely entry points.

Next is exploitation. The tester turns a finding into access using frameworks like Metasploit, custom scripts, or hand-crafted payloads for things like SQL injection, server-side request forgery, or broken authentication. The Burp Suite proxy is the standard tool for attacking web apps because it lets you intercept and tamper with every request.

After the first foothold comes post-exploitation: privilege escalation to admin or root, lateral movement to other machines, and persistence to survive a reboot. This stage answers the question that matters to the business: once in, how far can the attacker go? The engagement closes with a report that ranks each finding by severity, usually with CVSS scores, and gives concrete remediation steps.

Run a pentest before launching a new product, after a major architecture change, and on a regular cadence such as annually or quarterly for sensitive systems. Many compliance frameworks force the issue: PCI DSS requires annual penetration tests plus tests after significant changes, and SOC 2 and HIPAA audits expect them too.

The main trade-off is that a pentest is a point-in-time snapshot. It tells you the system was exploitable on the days it was tested, not that it is secure forever. Deploy new code the next week and the result can go stale. This is why teams pair scheduled pentests with continuous scanning and a bug bounty program for ongoing coverage.

Cost and risk are the other considerations. A quality external pentest from a firm like NCC Group or Bishop Fox can run from a few thousand to well over fifty thousand dollars depending on scope. There is also real operational risk: an aggressive test can crash a fragile service, so production tests need careful scoping, rate limits, and a clear escalation contact.

Say a fintech startup hires a tester to assess its customer portal. In recon the tester finds a forgotten staging subdomain, staging.bank-app.com, still pointing at a live server. The login page there has a SQL injection flaw in the username field.

The tester confirms it with a single payload that dumps the users table, including bcrypt password hashes and an admin account. They crack a weak admin password offline, log into the staging admin panel, and discover it shares a database with production. From there they read live customer balances.

None of these flaws were critical alone: a stale subdomain, one injectable field, a weak password, a shared database. Chained together they expose real customer money. The report walks the team through that exact chain and recommends decommissioning staging, using parameterized queries, enforcing strong admin passwords with MFA, and isolating the production database. That story, not a list of isolated scanner hits, is what makes pentesting valuable.