# Penetration testing

> Hiring someone to break into your systems, with permission, before a criminal does.

- Level: Intermediate
- Topics: Security
- URL: https://tidbit.legios.com.ar/penetration-testing/
- In Spanish: [Pruebas de penetración](https://tidbit.legios.com.ar/es/penetration-testing/)

**Penetration testing**, or **pentesting**, is an authorized, simulated attack on an organization's systems. A company hires security specialists, agrees in writing on what they may touch and when, and lets them try to get in the way a real attacker would: through the website, the office Wi-Fi, a forgotten server, or a convincing phone call to the help desk. At the end they deliver a report: what they reached, how, how serious it is, and how to fix it.

The point is to find the gaps that checklists miss. An automated scanner can list software with a known vulnerability; a human tester notices that a minor bug on the login page, combined with a reused password and an overly broad permission, adds up to full access to customer data. That chain of small problems is usually how real breaches happen.

What separates a pentest from an attack is consent and rules. The **scope** says which systems are in and which are off limits, the **rules of engagement** say what is not allowed (no deleting data, no testing during the payroll run), and the client knows it is happening. Tests come in flavors: **black box** (the tester starts knowing nothing, like an outsider), **white box** (they get the source code and diagrams) and gray box in between. A **red team** exercise is a longer, stealthier version that also tests whether the defenders notice.

Pentests are often required by regulators, card payment rules or large customers, typically once a year and after big changes. They are a snapshot, not a guarantee: they show what one team found in a limited time. The value is in fixing what they found and retesting.

## An analogy

Paying a locksmith to try to get into your house while you watch, then hand you a list: the back window latch is weak, the spare key under the plant is obvious, the side gate does not lock.

## Keep in mind

- A pentest is a simulated attack with written permission and a defined scope.
- Humans find chains of small weaknesses that automated scanners miss.
- The deliverable is a report with findings, severity and fixes.
- It is a snapshot in time; retest after fixing and after big changes.

## Go deeper

- [Penetration testing (NIST glossary)](https://csrc.nist.gov/glossary/term/penetration_testing)
- [OWASP Web Security Testing Guide](https://owasp.org/www-project-web-security-testing-guide/)
- [Penetration test on Wikipedia](https://en.wikipedia.org/wiki/Penetration_test)

## Related terms

- [Wi-Fi](https://tidbit.legios.com.ar/wi-fi/): Networking over radio waves: the internet without the cable, within a few rooms.
- [Server](https://tidbit.legios.com.ar/server/): A computer whose job is to answer requests from other computers, all day, every day.
- [Vulnerability and CVE](https://tidbit.legios.com.ar/vulnerability-and-cve/): A flaw that lets an attacker misuse software, and the public id that names it.
- [Bug](https://tidbit.legios.com.ar/bug/): A mistake in software that makes it behave differently from what was intended.
- [Source code](https://tidbit.legios.com.ar/source-code/): The human-readable text that programmers write and that a program is built from.