What is penetration testing?
Penetration testing, or pen testing, is a sanctioned attack. Testers working under written permission, inside an agreed scope and schedule, use the same techniques as real attackers to get as far into the environment as they can. A vulnerability scan stops at listing weaknesses that are probably present; a penetration test tries them, weeds out the ones that are not real and links minor issues into a path to something serious. The deliverable is a report that shows, with evidence, what was achieved and how to close each gap. Standards often mandate testing: PCI DSS expects internal and external tests at least once a year and whenever the environment changes significantly.
Authorization and rules of engagement
Without written permission, a penetration test is a crime, for example a violation of the U.S. Computer Fraud and Abuse Act. Permission has to come from someone with authority over the specific assets, and for assets that a cloud provider, hosting company or partner operates, testers must also follow that party's testing rules or get its consent. The rules of engagement turn permission into limits: in-scope and out-of-scope addresses, domains and buildings, testing windows, prohibited techniques such as denial of service or destructive payloads, handling of captured data and credentials, how critical findings are reported during the test and who to call to stop work.
Known, partially known and unknown environments
| Environment | Older term | Testers start with | Best for |
|---|---|---|---|
| Known | White box | Diagrams, source code, accounts | Depth in a short engagement |
| Partially known | Gray box | Some details, such as a standard user account | Phished-user and insider scenarios |
| Unknown | Black box | The organization's name and the scope only | A realistic outsider view |
Phases of a penetration test
- Planning and authorization: scope, rules of engagement and contacts.
- Reconnaissance: passive, from public sources such as WHOIS, DNS, certificate transparency logs, job postings and social media; then active, such as ping sweeps, port scans and banner grabbing that touch the target.
- Scanning and enumeration: services, versions, users and shares.
- Exploitation: gaining initial access.
- Post-exploitation: privilege escalation, lateral movement and pivoting to show how far access extends.
- Reporting: executive summary, findings, evidence, risk ratings, reproduction steps and recommendations.
- Cleanup: removing the accounts, files and tools the testers created.
Test types and team colors
A physical penetration test checks whether testers can tailgate through badge doors, talk past reception or plug into live network ports in public areas; the testers keep a signed letter of authorization on them in case staff, guards or police intervene. Offensive testing is red team work: emulating a realistic adversary toward goals such as reaching the payment database, often without telling the defenders. Defensive testing measures the blue team, the SOC and responders, on detection and response. Integrated, or purple team, testing has both sides working together, one technique at a time, to improve detections quickly.
Penetration testing vs. vulnerability scanning
Scans are automated, broad and frequent, and they report likely weaknesses one at a time. Penetration tests are human-led, scoped and periodic, and they prove which weaknesses are exploitable and how they combine. A bug bounty program adds a third option: outside researchers testing continuously and being paid per valid finding.
Penetration testing on the CompTIA Security+ exam
Penetration testing is tested under SY0-801 objective 5.5, which covers audits and assessments, including test environments, offensive, defensive, integrated and physical testing, and passive and active reconnaissance. Objective 4.3 adds reading a test report and turning its findings into verified, prioritized remediation work. Wording such as confirm the flaw is actually exploitable or show how far an intruder could go points to a penetration test, while find unpatched software on every server points to a vulnerability scan. Testers given source code and diagrams are in a known environment; testers given only the company name are in an unknown one. WHOIS lookups and job postings are passive reconnaissance, and any port scan is active. When a scenario has no written approval from the owner of the systems, the correct response is to halt testing until that approval exists.