The Basics of Website Penetration Testing | CyberHunter Solutions

Penetration testing is a simulation of a hacker's assault on a website or application to determine the severity of existing vulnerabilities. In other words, penetration testing is concerned with how each of these flaws could be exploited, as compared to a vulnerability assessment, which just detects and lists all current weaknesses on your website.

Consider, for instance, a criminal attempting to enter your home to rob you; you would first want to implement security measures to prevent the robber from entering. Here, vulnerability assessment is analogous to ensuring all of your home's windows and doors are shut. Even if a robber attempts to enter, he or she will not locate any entrance points, and you can sleep well.

Vulnerability assessment is the beginning phase of the whole procedure. In contrast, online website security testing or “pentesting” exploits the results (the list of vulnerabilities) to determine the risk associated with the website. Assessments of vulnerability use both automatic and human scanning. In contrast, penetration testing is often performed manually by trained security experts.

Typically, web service pentesting is conducted in 3 phases:

1. Information Collection: In information collection, the penetration tester looks for fingerprints in the website's backend. Typically, this covers Server OS, CMS version and so forth.

2. Discovering: In the second stage, automated technologies are used to identify any known security vulnerabilities (CVEs) in the relevant services. In this case, a human security scan by engineers is also necessary to identify business logic vulnerabilities, since automated methods often overlook these types of issues.

3. Exploitation: The objective of the last phase (exploitation) is to exploit any vulnerabilities detected in the second phase. This is often performed manually to eliminate false positives. Additionally, the exploitation phase is utilized to exfiltrate information from the target (and sustain persistence).