External Penetration Testing: A Brief Guide

In Q2 2021 , publicly reported data breaches in the U.S. are up by 38% over Q1. Moreover, 78% of IT security leaders believe their organizations lack sufficient protection against cyberattacks. What is more, the average cost of a data breach has risen from $3.86 million in 2020 to $4.24 million – an almost 10% increase.

Given these facts, strong cybersecurity is an absolute must. For this, organizations must regularly assess their security posture, and proactively find weaknesses in it. Here’s where penetration testing is invaluable.

Penetration testing is about “thinking like a hacker.” Pen testers identify which vulnerabilities exist in the enterprise network, systems or applications, how they could be exploited by cybercriminals, and the impact of such exploitation. In other words, purposefully being “hacked” now is better than unwittingly being hacked later.

External penetration testing – also known as ethical hacking – involves testing perimeter systems from the perspective of an attacker who has no prior access to the network or systems. Perimeter systems are directly accessible over the Internet, and therefore most vulnerable to external attacks. Testers simulate the actions of real hackers to gain control over the network, find weaknesses, and assess the potential impact of a breach.

Difference Between Internal and External Penetration Testing

Internal penetration testing assumes that attackers – including malicious insiders – have already found a foothold into a compromised system, and are looking to elevate their presence and cause more damage, whether that is collecting data, installing malware/ransomware, or simply harming a business’ reputation. In this pen test, the tester requires access to the target system. They will attempt to access privileged user accounts or sensitive data sources by bypassing existing access controls.

• In external penetration testing, however, the tester takes the perspective of an attacker who has no prior access to the target system. This pen test is usually done on a “black box” basis, where the tester has no information about the system’s design, architecture, source code, credentials, or internal structure.
  

External Penetration Testing Methodology

The external penetration testing methodology is a tried-and-true collection of best practices that cover the following steps:

Scoping

First, the testing team understands the requirements for network/infrastructure assessment and defines the test scope. These can be very open, or get very specific. For example, a pentest may involve a customer-facing webpage, but will not cover employee email accounts. It is vital that the team know the scope of the test going into it.

Reconnaissance

They identify all network assets and security gaps that malicious actors may exploit to compromise the network. This may involve everything from keycard access at the front door to password strengths.

Data Collection

Information is collected about the target system, including databases, software versions, plugins, hardware, etc. Together, the Reconnaissance and Data Collection phases are known as “enumeration.”

Vulnerability Detection and Assessment

Testers actively look for flaws in the network, systems, and applications. This may include unpatched software, least privilege vulnerabilities, or pwned passwords.

Exploitation

Identified flaws are actively exploited to compromise a target using an exploit kit. The tester may use tools such as Metasploit or Netsparker, or compromised usernames and passwords may be used to log into an otherwise inaccessible network. 

Privilege Escalation

Testers try to gain greater control over the network by gaining higher privileges in a system, or by accessing other systems on the network. This may even include creating his or her own account, enabling the pentester to log in whenever he or she wants.

Data Exfiltration

The tester uses tools and techniques to extract data from the network, simulating the actions of hackers. In a pentest, this is unlikely to be anything sensitive or dangerous, but in a real-world attack, that could be devastating.

Reporting

All identified issues and recommendations are documented, so the organization can produce an accurate threat and risk assessment. The pentester may even schedule a follow-up test, to see if any remediations have been effective.

External Penetration Testing Steps

Step 1: Planning and Reconnaissance

This initial phase focuses on gathering relevant information about the target system and preparing an asset inventory.

Step 2: Establish Objectives and Scope of Work

Next, the testers define the test objectives and scope of work. This enables them to identify the key performance indicators to gauge the success of the test. They also define test limitations to ensure the security of all assets and information.

Step 3: Scan Target System

The testers test the system to find exploitable vulnerabilities with Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), or both. They also quantify the potential security risks if vulnerabilities remain unaddressed.

Step 4: Gain System Access

Once they identify the system’s core weaknesses – insecure code, lack of encryption, authentication flaws, user session management loopholes, etc. – external pen testers leverage them to gain access to the system.

Step 5: Maintain Access

The tester attempts to retain persistent access, and remain undetected by system safeguards.

Step 6: Exploit the System

The external pen tester attempts to access confidential data and identifies all the possible routes they took to achieve this objective. They also exploit vulnerabilities and identify threats. They remain within the agreed-upon scope to ensure that data remains protected.

Step 7: Prepare a Report

Once the external pen test is complete, the testing team prepares a comprehensive report that documents the test results and includes recommendations for improvement. The report explains the test purpose, tactics and techniques used, and risk levels.

Many tools are available to conduct external penetration testing. These include:

• Metasploit : Tool to verify vulnerabilities, manage security assessments, and improve security awareness
• Nikto : Open source web server scanner that looks for potentially dangerous files/programs, outdated versions, and version-specific problems
• Wireshark : An open-source network protocol analyzer to assess traffic for vulnerabilities in real-time
• Nmap (Network Mapper) : A port scanner for network discovery, security auditing, and host/service uptime monitoring
  

Evolve supports automated, on-demand, real-time external penetration testing to quickly detect and verify critical security weaknesses. The solution combines automated reconnaissance and active attacks with intelligent and safe exploitation against publicly accessible infrastructure to provide deep insights into Internet-based risks. It empowers security teams to effectively identify and reduce business-critical risks, and stay on top of the latest threats.

Conclusion

To protect any organization from data breaches and cyberattacks, identifying security gaps in the network infrastructure is critical. External penetration testing helps answer two extremely important questions:

• How could a hacker penetrate our network to compromise our applications or steal our data?
• How can we find and fix open vulnerabilities before that exploitation happens?

External penetration testing helps your business to immediately take corrective action against flaws and vulnerabilities, and stay several steps ahead of threat actors.