Penetration Testing

Penetration testing (pen testing) is an authorised, simulated attack on a system, network or application to find security weaknesses before real attackers do. Testers use the same tools and techniques as attackers, within an agreed scope and rules of engagement, and report what they found and how to fix it.

A vulnerability assessment scans for and lists known weaknesses; a penetration test goes further and tries to exploit them to show the real impact. Together they are often called VAPT. Tests can be black box (no inside knowledge), grey box or white box (full access to code and design). Burp Suite, Nmap and Metasploit are common tools.