Penetration testing (often called "pen testing" or "ethical hacking") is an authorised, simulated cyber attack on a computer system, network, or application, conducted to discover security vulnerabilities before malicious attackers do. The fundamental idea is to think like an attacker while acting with permission.
What is the difference between a pen tester and a hacker?
The tools and techniques are often identical — the crucial difference is permission. A malicious hacker attacks systems without authorisation: this is a criminal offence under the Computer Misuse Act 1990. A penetration tester has explicit written permission from the system owner and a clearly defined scope of what may be tested. The ethical hacker's goal is to find weaknesses and report them so they can be fixed — not to exploit them for personal gain. "Ethical hacking" is a career; the UK's NCSC actively promotes it as a skill the country needs.
What are the stages of a penetration test?
A structured pen test follows a recognised methodology:
| Stage | Name | What happens |
|---|---|---|
| 1 | Reconnaissance | Gather information about the target (public records, IP ranges, employee names, technology stack) without directly probing the system |
| 2 | Scanning | Actively probe the target to identify open ports, services, operating system versions, and potential entry points |
| 3 | Exploitation | Attempt to exploit discovered vulnerabilities to gain access — always within the agreed scope |
| 4 | Post-exploitation | Once inside, determine how much access is possible: escalate privileges, access sensitive data, move laterally across the network |
| 5 | Reporting | Document every finding, its severity, and specific remediation recommendations; present to the client |
The report is the most important deliverable — findings that are not clearly communicated cannot be fixed.
What are the three types of penetration test?
The "colour" of the test refers to how much information the tester is given about the target before starting:
| Type | Knowledge given | Simulates | Advantage |
|---|---|---|---|
| Black box | No prior knowledge | External attacker with no inside information | Realistic external attack simulation |
| White box | Full access: source code, architecture diagrams, credentials | Insider threat or post-breach assessment | Thorough; finds deep vulnerabilities |
| Grey box | Partial information (e.g. user-level account, some documentation) | Compromised employee or partially informed attacker | Balance of realism and thoroughness |
Most real-world engagements are grey-box: full black-box testing misses vulnerabilities an attacker who has done basic research would find; full white-box tests are most useful for code security audits.
What common vulnerabilities do penetration testers look for?
| Vulnerability category | Example | How a tester finds it |
|---|---|---|
| Weak passwords | admin/admin default credentials |
Password spraying, dictionary attack |
| Unpatched software | Known CVE (vulnerability) in old software version | Version fingerprinting during scanning |
| SQL injection | User input passed directly into a database query | Inject ' OR 1=1 -- into login fields |
| Open ports | RDP (port 3389) exposed to the internet | Port scanning |
| Misconfigured permissions | World-readable sensitive files | Directory traversal, file access |
| Social engineering | Staff tricked into revealing credentials | Simulated phishing campaigns |
SQL injection is worth understanding at GCSE: if a login form passes the username directly into a SQL query without checking for special characters, an attacker can type ' OR '1'='1 as a username, which makes the query always return true and bypasses authentication entirely.
What legal and ethical rules govern penetration testing?
| Rule | Detail |
|---|---|
| Written authorisation | A signed scope document from the system owner is mandatory before any test begins |
| Defined scope | The tester may only test systems explicitly listed; testing others is criminal |
| Computer Misuse Act 1990 | Unauthorised access to computer systems is illegal; penalties include up to 10 years imprisonment |
| Data Protection | Any personal data encountered during a test must be handled responsibly and not retained |
| Responsible disclosure | Vulnerabilities found must be reported to the client; not exploited or published without permission |
Professional pen testers operate within frameworks such as CREST (Council of Registered Ethical Security Testers) or hold certifications like CEH (Certified Ethical Hacker) or OSCP (Offensive Security Certified Professional).
Frequently asked questions
Is penetration testing the same as vulnerability scanning?
No. Vulnerability scanning uses automated tools to identify known weaknesses (e.g. unpatched software, open ports) — it produces a list of potential issues. Penetration testing goes further: a human tester actively attempts to exploit those vulnerabilities to determine whether they are actually exploitable and how severe the real-world impact would be. Scanning finds possible weaknesses; pen testing proves whether they can be used to cause harm.
What is the Computer Misuse Act 1990 and how does it relate to pen testing?
The Computer Misuse Act 1990 is the UK law that criminalises three key offences: (1) unauthorised access to computer material, (2) unauthorised access with intent to commit further offences, and (3) unauthorised modification of computer material. Penetration testing operates legally because it has explicit authorisation — the "unauthorised" element is absent. Any testing outside the agreed scope, or without written permission, is a criminal offence regardless of the tester's intentions.
Can students legally practise penetration testing?
Yes, through legal means: using your own equipment, using deliberately vulnerable platforms (TryHackMe, Hack The Box, OWASP WebGoat), or participating in authorised bug bounty programmes run by companies like Google, Microsoft, and HackerOne. These provide safe, legal environments where discovering vulnerabilities is explicitly welcomed and rewarded. Attempting to test a school network, a website, or any system you do not own — even without malicious intent — is illegal.
What is a CVE number?
CVE stands for Common Vulnerabilities and Exposures — a publicly maintained database of known software security flaws, each assigned a unique identifier (e.g. CVE-2021-44228, the Log4Shell vulnerability). Penetration testers use CVE databases to check whether a target's software versions have known vulnerabilities. Organisations use them to prioritise patching. Staying current with CVEs — and patching promptly — is one of the most effective defences against exploitation of known vulnerabilities.
Explore cyber security and ethical hacking concepts with Professor Turing's guided question sessions at aitutors.me.