Let us begin a new little.
Phases of penetration testing.
In this lecture, we will see the five important phases of penetration testing, which are being categorized
into three main categories.
Let's explore the first one that is the pre attack fits in this phase, planning and preparation is
very crucial then which meterology we are going to use for the test is decided.
And then the network and information gathering, a penetration test also known as a pen test at a simulated
cyber attack against your computer system to check for expert nativities.
Insights provided by the penetration tester can be used for fine tune your security policies and patch
detected vulnerabilities before you do a penetration testing, which is always important to create a
proper model which involves the following pieces.
The first one is planning and reconnaissance.
The first stage involves defining the scope and goals of a test, including the systems to be addressed
and the testing methods to be used.
Gathering intelligence that is network and domain names to better understand how Watergate works is
also important.
The next is a attack phase in this phase, the penetration perimeter is decided, then acquiring the
target access and then escalating privileges is important.
No attack phase involves the following phases, first one is scanning, scanning is to understand how
the target application and respond to various intrusion attempts.
This is typically done using static analysis and dynamic analysis.
The next is gaining access that is acquiring target.
This stage uses of application attacks such as cross scripting, skill injection and back those.
Testers then try and exploit these vulnerabilities typically by escalating privileges, stealing data,
intercepting traffic to understand the damage they can cause.
And the last is maintaining access, the goal of this day is to see if the world really can be used
to achieve a persistent presence in the water system that is too long enough for a bad actor to gain
in-depth access.
The idea is to initiate, which often remain in a system for months in order to steal an organization's
most sensitive data and expectation.
And the finalist post attack office here, analysis of the attack is done, the results of the penetration
test are then compiling to a report, which we often call as a report documenting the specific vulnerabilities
that we exploited, sensitive data that does exist and the amount of the time spent testing was able
to remain in the system undetected.
This information is analyzed by security personnel to help configure an enterprise framework settings
and application security solutions to patch vulnerabilities and protect against future attacks.
So whenever you're going to do a penetration test, make sure that you follow all these steps and do
not randomly start attacking the application.
If you are a professional penetration test, you must follow all these three phases in order to carry
out successful penetration test.
In the next lecture, we'll see the top 10 things a security expert looks for whenever he performs a
security test.