FAQ

Introduction to Pentesting

A penetration test (often called pentest for short) is a controlled, planned and authorized attack on IT systems, applications or networks to identify vulnerabilities before real attackers can find and exploit them.

The objective of a penetration test is to assess the security posture of an organization under realistic conditions. The test simulates attacks against systems, applications, and networks in order to identify vulnerabilities and to objectively evaluate the effectiveness of existing security measures. The central question is how far an attacker could actually get in practice and what risks would result.

From this approach, several key aspects arise:

• Vulnerability analysis: Identification of technical and conceptual flaws in applications, networks, and configurations.
• Practical exploitability: Verification of whether identified vulnerabilities can actually be exploited and what the impact would be.
• Testing security controls: Evaluation of whether existing defensive measures detect or prevent attacks.
• Realistic attack scenarios: Execution of tests under different conditions (e.g., external attackers without prior knowledge or internal attackers with limited privileges).
• Risk classification: Categorization of findings to prioritize remediation efforts.

Beyond the technical level, a penetration test provides a foundation for risk management: organizations gain transparency into their actual attack surface, can further develop their security strategy, and obtain verifiable evidence for customers, partners, or auditors. In this way, IT security becomes measurable and verifiable as a continuous process.

In general, there are different ways to categorize penetration tests: by their objective and by the amount of information provided by the client. The latter is sometimes also referred to as the penetration test methodology, but this is misleading. The methodology actually describes how the penetration tester proceeds – meaning according to which standard or with what technical process the penetration test itself is conducted.

The amount of information provided is typically classified into Black Box, Gray Box, and White Box testing. In a Black Box penetration test, the tester receives no information from the client, aside from a rough target. In a White Box penetration test, the tester is given full insight into systems, architecture, source code, etc. In a Gray Box penetration test – which is the most commonly used approach – the tester receives more information than would be publicly available. The idea behind this is to enable an effective and efficient execution of the penetration test. For example, during a web application test, the penetration tester might try to guess which database is used. The client can simply inform the tester (even just upon request), saving time and allowing for more targeted testing.

Penetration tests can also be categorized based on the attack vector. Typically, a distinction is made between external and internal penetration tests. An external penetration test is conducted from outside, via the Internet, while an internal penetration test – as you might expect – is carried out from a point inside the company's network. Generally, it is recommended to first perform an external penetration test due to the higher exposure and then follow up with an internal test. However, it is often during internal penetration tests that the most serious security vulnerabilities are discovered.

A Vulnerability Scan is an automated tool that scans web applications, systems, or networks for known vulnerabilities, such as outdated software, missing patches, or misconfigurations. In practice, you input target information (like IP addresses or domain names), click "SCAN," and receive a report listing the identified vulnerabilities. These scans are fully automated and typically limited to detecting previously discovered issues in software components.

A Penetration Test, on the other hand, is a simulated attack on web applications, systems, or networks, also aimed at identifying vulnerabilities. However, it is conducted manually by an experienced penetration tester, who uses a wide range of tools, advanced attack techniques, and a structured testing methodology. This approach makes it possible to uncover new or complex vulnerabilities and potentially exploit them—depending on the defined scope of the test.