97 Things Every Information Security Professional Should Know

Chapter 35. Penetration Testing: Why Can’t It Be Like the Movies?!

Jasmine M. Jackson

What is the first thought when hearing the words “penetration testing”?

Penetration testing in the general sense exploits vulnerabilities that are found in computer systems. A vulnerability is a flaw in a computer system. An analogy to a vulnerability is if you’re not at home but you leave your window open. It’s a vulnerability as one can go through your window and enter your home. In our analogy, a penetration test would be a burglar entering your home through the open window to steal items from your home.

When most people hear penetration testing their minds automatically go to television shows or movies they have watched where the character opens a command prompt and starts typing commands. The character automatically finds the perfect exploit to gain access to the system. After gaining access to the system, they’re able to find the pertinent information and everything is well. Is this how it works in the real world? No. In reality, there are five phases of penetration testing—information gathering, reconnaissance, discovery and scanning, exploitation, and reporting.

From the five phases, the most important is reconnaissance. The reason for this is you need to know your target before exploiting it. I made this mistake early on when learning penetration testing, by skipping the first three ...