Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

05:45 PM
Connect Directly

A Day in The Life of a Pen Tester

Two penetration testers share their day-to-day responsibilities, challenges they encounter, and the skills they value most on the job.

All organizations have vulnerabilities, but they can't fix them until they find them. It's the job of penetration testers to put themselves in an attacker's shoes and find flaws before the bad guys do.

Penetration testing, also known as pen testing, involves testing networks, computer systems, and Web and mobile applications to discover vulnerabilities that could potentially put an organization at risk. Pen tests may simulate human- or technology-based social engineering attacks against an organization's employees to see how people could put a business at risk.

Some companies have penetration testers on their internal security team to test products and systems for vulnerabilities. Many outsource pen testing to consulting or professional services firms, which are staffed with professionals who are trained to break into systems and report back to the client which applications or systems were breached, how they were exploited, and how the organization can mitigate those issues to defend against future cyberattacks.

Security consultant Gisela Hinojosa and security analyst Carlota Bindner are pen testers at Rapid7. The two women are on separate teams under the firm's penetration testing division, and both spend their days on internal and external network penetration testing, mobile and Web application testing, Internet of Things (IoT) testing, and other engagements. "It depends on the type of assessment you're on," says Hinojosa, who has been pen testing at Rapid7 for about three years. 

What does a pen tester's day look like? Mornings are usually pretty busy, she says, as that's when the testing starts. If she's doing an internal pen test, she'll set up the tools she needs and start by collecting open source intelligence (OSINT), which she can use to launch attacks. Hinojosa spends most of the day testing, with occasional meetings throughout the day. The typical engagement lasts about five days but can be shorter or longer depending on the project. 

External pen testing is the practice of testing an organization's externally facing assets. During an external pen test, testers try to access the internal network by exploiting flaws found on external assets. They have to collect intel on open ports, vulnerabilities, and other aspects of the business to launch their attack. Once they're in, they can move on to the internal pen test. External pen tests are more introductory; internal tests involve more detail and complexity.

"That's when we find the most loot," says Hinojosa, who adds internal testing is usually more rewarding because that's when they're trying to gain domain administrative access. "But it's also a lot more work, especially with reporting, because that's when you have the most findings." The amount of required reporting also varies by project, she continues, but they try to start compiling the reports by midweek so as to not leave everything until the last minute.

Bindner, who also spends most of her days testing devices and systems, with meetings throughout, says the flow of her engagements is similar: OSINT, scanning, enumeration, and finding and exploiting vulnerabilities. Internal and client meetings mark the beginning and end of the day, so the client knows when testing has begun and receives an overview of what was found at day's end. "It's to keep them informed throughout the engagement," she explains. 

The process and tools involved depend on what the assessor is breaking into. If they're testing a Web application, for example, they're given a URL to test on. For external networks, they're given IP addresses; for mobile applications, they're given the name of the app to download or the .IPA file if the app hasn't yet been released, Hinojosa says. Mobile testing also requires a jailbroken iOS device or a rooted Android device. IoT testing demands equipment, such as soldering stations to remove chips, and oftentimes debugging hardware and software are required, Bindner adds. Rapid7 has a lab, she says; some testers have their own supplies.

"It's not just about the device sitting alone," she says of the complexities of IoT testing. "It's all the different components it interacts with."

Pen Testing Problems and Perks
One of the frustrations of pen testing is "we are provided a limited amount of time to perform the job we do," Bindner says. Pen testers have to stay within the scope of each engagement, she continues. Sometimes she'll find something she's interested in and want to keep digging deeper, but the limits of the engagement mean they have to move on to finish in time.

On the flip side, Hinojosa says, sometimes clients want to add something to the scope of a project that wasn't agreed on before, which can interfere with the engagement timeline.

Despite frustrations, both women say they enjoy pen testing because "it's like a puzzle you're trying to solve, and it's a challenge," says Hinojosa, a former quality assurance analyst who did software testing for six years before joining Rapid7. She brought her software testing skills to her new role, where she learned from colleagues and was trained on the job to become a pen tester. 

"There's something very rewarding about knowing … while our actions might be those of an attacker's, we're doing it to make sure companies are safer in the long run," says Bindner, whether those actions are getting cross-site scripting on a website or moving from an external network to an internal one. Bindner, who has a degree in animal science, went through the SANS Women's Academy and then trained in Rapid7's security consultant development program.

Both women agree research skills are paramount to succeeding as a pen tester, as there are new vulnerabilities frequently coming out and many different attack scenarios they may not be aware of, Hinojosa says. They're always researching and learning to stay in the loop. It's not just about being able to search something, they agree, but understanding what to look for.

"This field, much like in any other complex field, requires continuous learning," Bindner sayss.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's featured story: "Untangling Third-Party Risk (and Fourth, and Fifth...)."

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
7 Old IT Things Every New InfoSec Pro Should Know
Joan Goodchild, Staff Editor,  4/20/2021
Cloud-Native Businesses Struggle With Security
Robert Lemos, Contributing Writer,  5/6/2021
Defending Against Web Scraping Attacks
Rob Simon, Principal Security Consultant at TrustedSec,  5/7/2021
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: Take me to your BISO 
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-05-10
IBM Cloud Pak for Security (CP4S) and could allow a user to obtain sensitive information or perform actions they should not have access to due to incorrect authorization mechanisms. IBM X-Force ID: 198919.
PUBLISHED: 2021-05-10
IBM Control Desk and is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 199228.
PUBLISHED: 2021-05-10
IBM Cloud Pak for Security (CP4S) and is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force I...
PUBLISHED: 2021-05-10
Ticketer is a command based ticket system cog (plugin) for the red discord bot. A vulnerability allowing discord users to expose sensitive information has been found in the Ticketer cog. Please upgrade to version 1.0.1 as soon as possible. As a workaround users may unload the ticketer cog to disable...
PUBLISHED: 2021-05-10
An exploitable denial-of-service vulnerability exists in Systemd 245. A specially crafted DHCP FORCERENEW packet can cause a server running the DHCP client to be vulnerable to a DHCP ACK spoofing attack. An attacker can forge a pair of FORCERENEW and DCHP ACK packets to reconfigure the server.