Penetration Test

Updated 31 Jul 2026

•
def
- •
  a simulated attack, similar to Vulnerability Scanning but going further — actually attempting to exploit the vulnerabilities found; often a compliance mandate
•
perspectives
- •
  offensive (red team) — attacks the systems and looks for vulnerabilities to exploit
- •
  defensive (blue team) — identifies attacks in real time and prevents unauthorized access
- •
  integrated — an ongoing process combining both, identifying/patching exploitable systems and testing again
•
working knowledge
- •
  known environment (full disclosure), partially known environment (mix of known/unknown, focused on certain systems), or unknown environment (a "blind" test)
•
reconnaissance
- •
  passive — learning from open sources (social media, the corporate website, forums, social engineering, dumpster diving) without touching the target directly
- •
  active — actually probing the target (ping/port scans, DNS queries, OS/service/version fingerprinting) — visible in network traffic and logs
•
the exploitation process
- •
  initial exploitation — gaining the first foothold in the target environment
- •
  Lateral Movement
- •
  Persistence (Penetration Testing)
- •
  The Pivot
•
physical penetration testing
- •
  assessing whether physical security can be circumvented (modifying the boot process, booting from other media, entering a building without a key)
•
rules of engagement
- •
  a document defining the test's purpose, scope, type/schedule, IP ranges, emergency contacts, and how to handle sensitive information found during the test
•
related
•
cards
- •
  Distinguish red team from blue team
  - •
    Red team: offensive, attacks systems to find exploitable vulnerabilities; blue team: defensive, identifies attacks in real time and prevents unauthorized access

Linked references 6

◌ Explore connections in Graph view