A real test, not a scan

A penetration test is an authorised, scoped attempt to find and demonstrate weaknesses in a system, ending in a report the organisation can act on.

It is not a vulnerability scan, which is automated and produces a list of possible issues, many of which are false positives and most of which are not exploitable in that environment. A scan is an input to a test rather than a test, and selling one as the other is common and dishonest.

The authorisation comes first, always. The ethical hacking course in this catalogue covers it in detail, and the summary is that under PECA unauthorised access is an offence regardless of intent or damage, and that authorisation must be written, from somebody with the authority, naming the specific systems, dates and techniques.

The types. Black box, where you are given nothing and simulate an outside attacker. White box, where you are given full information including source and credentials, which finds far more in the same time. And grey box, which is somewhere between and is what most engagements actually are.

What a test covers is agreed in advance: external network, internal network, a web application, a mobile application, wireless, or social engineering, which needs particular care and explicit permission.

Set the rules of engagement. What is out of scope, what times testing may occur, what to do if something breaks, who to contact immediately, and whether denial of service is permitted, which it usually is not.

And agree what happens if you find something critical, because a serious finding should be reported immediately rather than saved for the report.