A vulnerability scanner says “this door might be open”; a penetration test shows “we got in through this door and reached this far”. Penetration testing is an authorised, controlled security assessment in which specialists test a system with an attacker's mindset.
Types by prior knowledge
- Black box: the testers know only a domain name or address — like an external attacker.
- Grey box: a normal user account or limited documentation is provided — the most common and efficient option.
- White box: access to source code and architecture — the deepest coverage.
Types by target
- Web applications and APIs
- Internal and external infrastructure and networks
- Mobile applications
- Smart contracts and blockchain systems
- Social engineering and phishing
- Wireless networks
Phases of a standard penetration test
1. Scope and rules of engagement
Permitted assets, the time window, forbidden techniques (such as denial of service) and an emergency contact are agreed in writing. No test happens without written authorisation.
2. Reconnaissance
Collecting public information: subdomains, technologies, staff and past leaks.
3. Scanning and enumeration
Identifying ports, services, versions and application entry points.
4. Exploitation
Controlled attempts to prove vulnerabilities, with minimal impact on production.
5. Post-exploitation
Assessing how far the obtained access goes: privilege escalation, lateral movement and access to sensitive data.
6. Reporting
A good report has two parts: an executive summary of business risks, and technical details for every finding with severity, evidence, reproduction steps and remediation.
7. Retesting
After fixes, findings are checked again to confirm the remediation works.
How often?
At least once a year, and after every major architecture change, major release or infrastructure migration. For financial and blockchain systems a test before every public release is essential.
A penetration test is a snapshot of your security at one moment; lasting security comes from combining it with secure development and continuous monitoring.
