Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

4/2/2020
05:45 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

A Day in The Life of a Pen Tester

Two penetration testers share their day-to-day responsibilities, challenges they encounter, and the skills they value most on the job.

All organizations have vulnerabilities, but they can't fix them until they find them. It's the job of penetration testers to put themselves in an attacker's shoes and find flaws before the bad guys do.

Penetration testing, also known as pen testing, involves testing networks, computer systems, and Web and mobile applications to discover vulnerabilities that could potentially put an organization at risk. Pen tests may simulate human- or technology-based social engineering attacks against an organization's employees to see how people could put a business at risk.

Some companies have penetration testers on their internal security team to test products and systems for vulnerabilities. Many outsource pen testing to consulting or professional services firms, which are staffed with professionals who are trained to break into systems and report back to the client which applications or systems were breached, how they were exploited, and how the organization can mitigate those issues to defend against future cyberattacks.

Security consultant Gisela Hinojosa and security analyst Carlota Bindner are pen testers at Rapid7. The two women are on separate teams under the firm's penetration testing division, and both spend their days on internal and external network penetration testing, mobile and Web application testing, Internet of Things (IoT) testing, and other engagements. "It depends on the type of assessment you're on," says Hinojosa, who has been pen testing at Rapid7 for about three years. 

What does a pen tester's day look like? Mornings are usually pretty busy, she says, as that's when the testing starts. If she's doing an internal pen test, she'll set up the tools she needs and start by collecting open source intelligence (OSINT), which she can use to launch attacks. Hinojosa spends most of the day testing, with occasional meetings throughout the day. The typical engagement lasts about five days but can be shorter or longer depending on the project. 

External pen testing is the practice of testing an organization's externally facing assets. During an external pen test, testers try to access the internal network by exploiting flaws found on external assets. They have to collect intel on open ports, vulnerabilities, and other aspects of the business to launch their attack. Once they're in, they can move on to the internal pen test. External pen tests are more introductory; internal tests involve more detail and complexity.

"That's when we find the most loot," says Hinojosa, who adds internal testing is usually more rewarding because that's when they're trying to gain domain administrative access. "But it's also a lot more work, especially with reporting, because that's when you have the most findings." The amount of required reporting also varies by project, she continues, but they try to start compiling the reports by midweek so as to not leave everything until the last minute.

Bindner, who also spends most of her days testing devices and systems, with meetings throughout, says the flow of her engagements is similar: OSINT, scanning, enumeration, and finding and exploiting vulnerabilities. Internal and client meetings mark the beginning and end of the day, so the client knows when testing has begun and receives an overview of what was found at day's end. "It's to keep them informed throughout the engagement," she explains. 

The process and tools involved depend on what the assessor is breaking into. If they're testing a Web application, for example, they're given a URL to test on. For external networks, they're given IP addresses; for mobile applications, they're given the name of the app to download or the .IPA file if the app hasn't yet been released, Hinojosa says. Mobile testing also requires a jailbroken iOS device or a rooted Android device. IoT testing demands equipment, such as soldering stations to remove chips, and oftentimes debugging hardware and software are required, Bindner adds. Rapid7 has a lab, she says; some testers have their own supplies.

"It's not just about the device sitting alone," she says of the complexities of IoT testing. "It's all the different components it interacts with."

Pen Testing Problems and Perks
One of the frustrations of pen testing is "we are provided a limited amount of time to perform the job we do," Bindner says. Pen testers have to stay within the scope of each engagement, she continues. Sometimes she'll find something she's interested in and want to keep digging deeper, but the limits of the engagement mean they have to move on to finish in time.

On the flip side, Hinojosa says, sometimes clients want to add something to the scope of a project that wasn't agreed on before, which can interfere with the engagement timeline.

Despite frustrations, both women say they enjoy pen testing because "it's like a puzzle you're trying to solve, and it's a challenge," says Hinojosa, a former quality assurance analyst who did software testing for six years before joining Rapid7. She brought her software testing skills to her new role, where she learned from colleagues and was trained on the job to become a pen tester. 

"There's something very rewarding about knowing … while our actions might be those of an attacker's, we're doing it to make sure companies are safer in the long run," says Bindner, whether those actions are getting cross-site scripting on a website or moving from an external network to an internal one. Bindner, who has a degree in animal science, went through the SANS Women's Academy and then trained in Rapid7's security consultant development program.

Both women agree research skills are paramount to succeeding as a pen tester, as there are new vulnerabilities frequently coming out and many different attack scenarios they may not be aware of, Hinojosa says. They're always researching and learning to stay in the loop. It's not just about being able to search something, they agree, but understanding what to look for.

"This field, much like in any other complex field, requires continuous learning," Bindner sayss.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's featured story: "Untangling Third-Party Risk (and Fourth, and Fifth...)."

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 10/27/2020
Chinese Attackers' Favorite Flaws Prove Global Threats, Research Shows
Kelly Sheridan, Staff Editor, Dark Reading,  10/27/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-7384
PUBLISHED: 2020-10-29
Rapid7's Metasploit msfvenom framework handles APK files in a way that allows for a malicious user to craft and publish a file that would execute arbitrary commands on a victim's machine.
CVE-2020-21266
PUBLISHED: 2020-10-29
Broadleaf Commerce 5.1.14-GA is affected by cross-site scripting (XSS) due to a slow HTTP post vulnerability.
CVE-2020-5937
PUBLISHED: 2020-10-29
On BIG-IP AFM 15.1.0-15.1.0.5, the Traffic Management Microkernel (TMM) may produce a core file while processing layer 4 (L4) behavioral denial-of-service (DoS) traffic.
CVE-2020-5938
PUBLISHED: 2020-10-29
On BIG-IP 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, when negotiating IPSec tunnels with configured, authenticated peers, the peer may negotiate a different key length than the BIG-IP configuration would otherwise allow.
CVE-2020-25516
PUBLISHED: 2020-10-29
WSO2 Enterprise Integrator 6.6.0 or earlier contains a stored cross-site scripting (XSS) vulnerability in BPMN explorer tasks.