CompTIA Security+ Preparation · lesson 20 of 45 · 25 min
Penetration Testing Overview
A penetration test is an authorized, simulated cyberattack performed to evaluate the security of a system. The goal is to find and exploit vulnerabilities before real attackers do.
Rules of engagement (RoE) — written agreement defining the scope, targets, methods, and timing of the test. Must be signed before testing begins. Defines what is in-scope and out-of-scope.
Test types by knowledge level:
Black box — tester has no prior knowledge of the target. Simulates an external attacker. Most realistic but time-consuming.
White box (crystal box) — tester has full knowledge: source code, architecture, credentials. Most thorough. Used for code review and internal audits.
Gray box — tester has partial knowledge (e.g., user-level credentials). Simulates an insider or compromised account. Balance of realism and efficiency.
Penetration Testing Phases
1. Reconnaissance (Planning) — gather information about the target. Passive: OSINT, WHOIS, DNS lookups, LinkedIn, Shodan. Active: port scanning, service enumeration. Tools: Maltego, theHarvester, Recon-ng.
2. Scanning and Enumeration — identify open ports, services, OS versions, vulnerabilities. Tools: Nmap, Nessus, Nikto (web), enum4linux (SMB).
3. Exploitation — actively exploit discovered vulnerabilities to gain access. Tools: Metasploit, SQLmap, Burp Suite. Goal: establish initial foothold.
4. Post-Exploitation — after gaining access: privilege escalation, lateral movement, persistence, data exfiltration (simulated). Demonstrates real-world impact.
5. Reporting — document all findings, evidence, and recommendations. Executive summary (business impact) + technical report (detailed findings with CVSS scores and remediation steps).
Key Terms
Key Terms
Knowledge Check — 10 Questions
Security+ — Penetration Testing
Rules of engagement must be signed:
- After the test is complete
- Before testing begins
- Only for external tests
- Only for black box tests
- Answer: Before testing begins
RoE defines scope and authorization — testing without signed RoE is unauthorized access, which is illegal. A black box penetration test simulates:
- An insider threat
- An external attacker with no prior knowledge
- A developer reviewing code
- An auditor with full access
- Answer: An external attacker with no prior knowledge
Black box testing is the most realistic simulation of an external attacker — the tester starts with no knowledge of the target.
Metasploit is primarily used in which phase?
- Reconnaissance
- Scanning
- Exploitation
- Reporting
Answer: Exploitation
Metasploit is an exploitation framework — it provides modules for exploiting known vulnerabilities to gain initial access.
Post-exploitation activities include:
- Writing the final report
- Privilege escalation, lateral movement, and persistence
- Initial port scanning
- Passive OSINT
- Answer: Privilege escalation, lateral movement, and persistence
Post-exploitation demonstrates real impact — escalating privileges, moving to other systems, and maintaining access. A gray box test provides the tester with:
- No knowledge
- Full knowledge including source code
- Partial knowledge such as user credentials
- Only network diagrams
- Answer: Partial knowledge such as user credentials
Gray box simulates an insider or compromised account — the tester has some knowledge but not full access.
Shodan is used during which phase?
- Exploitation
- Post-exploitation
- Reconnaissance
- Reporting
Answer: Reconnaissance
Shodan is a search engine for internet-connected devices — used during passive reconnaissance to find exposed services.
The pen test report should include:
- Only technical findings
- Only an executive summary
- Both an executive summary (business impact) and a technical report (detailed findings)
- Only CVSS scores
Answer: Both an executive summary (business impact) and a technical report (detailed findings) Good reports serve two audiences: executives (business risk) and technical staff (detailed findings and remediation steps). Nmap is primarily used for:
- Exploiting vulnerabilities
- Port scanning and service enumeration
- Password cracking
- Social engineering
- Answer: Port scanning and service enumeration
Nmap discovers open ports, running services, OS versions, and network topology — essential for the scanning phase.
Penetration testing and vulnerability scanning are the same thing.
- True
- False
Answer: False
Vulnerability scanning is automated and non-exploiting. Pen testing actively exploits vulnerabilities to demonstrate real impact — much more thorough.
Privilege escalation means:
- Gaining access to a new system
- Obtaining higher permissions than initially granted
- Moving laterally through the network
- Exfiltrating data
- Answer: Obtaining higher permissions than initially granted
Privilege escalation: going from a standard user account to admin/root — dramatically increases the attacker’s capabilities.
Previous lesson: Vulnerability management lifecycle: identify, prioritize, remediate, verify
Back to CompTIA Security+ Preparation
Next lesson: Network security architecture: segmentation, DMZ, VPN, firewall