Penetration Testing Basics

Penetration testing, often called “pentesting”,“pen testing”, or “security testing”, is the practice of attacking your own or your clients’ IT systems in the same way a hacker would to identify security holes. Of course, you do this without actually harming the network. The person carrying out a penetration test is called a penetration tester or pentester.

The difference between Penetration Testing and Hacking is that you have the system owner's permission to do testing and to identfiy security holes. If you want to do penetration testing u should better ask for his/her permission.

Basic Security Concepts

Vulnerability: It is a security hole in a piece of software, hardware of Operating system that provides a way to attack the system.A vulnerabilty is as simple as weak passwords and as complex as buffer overflows as well as SQL injection.

Security Research: Vulnerabilities are typically searched by security researchers who finds the flaws in the system. Security Research can be good or evil.

Exploit : To take advantage of a vulnerability, you often need an exploit, a small and highly specialized computer program whose only reason of being is to take advantage of a specific vulnerability and to provide access to a computer system. Exploits often deliver a payload to the target system to grant the attacker access to the system.

Payload : A payload is the piece of software that lets you control a computer system after it’s been exploited. The payload is typically attached to and delivered by the exploit. Just imagine an exploit that carries the payload in its backpack when it breaks into the system and then leaves the backpack there. Yes, it’s a corny description, but you get the picture.

Metasploit’s most popular payload is called Meterpreter, which enables you to do all sorts of funky stuff on the target system. For example, you can upload and download files from the system, take screenshots, and collect password hashes. You can even take over the screen, mouse, and keyboard to fully control the computer. If you’re feeling particularly bad-ass, you can even turn on a laptop’s webcam and be a fly on the wall.