Penetration testing can be chaotic. Frameworks are the key to providing a structure for your tests and ensuring that you cover all of the necessary bases. We’ll discuss five different penetration testing frameworks and why you should follow them.
1. OWASP
The OWASP Foundation is dedicated to making the internet a safer and more secure place. They have released several open-source tools, testing frameworks, guides, checklists, you name it.
OWASP Top Ten
This is perhaps the best-known list of web application security risks that can be exploited by attackers. It’s important to note that this is not a list of specific vulnerabilities, but rather general attack categories. It is also updated annually. It includes:
- Broken Access Control
- Security Misconfiguration
- Cryptographic Failures
- Insecure Design
- Vulnerable and Outdated Components
- Identification and Authentication Failures
- Injection and Cross-Site Scripting
- Server-Side Request Forgery
- Software/Data Integrity Failures
- Security Logging and Monitoring Failures
OWASP Web Security Testing Guide
It provides a comprehensive guide to security testing web applications. It covers everything from initial reconnaissance to final report writing and works well for penetration testing. It covers:
- Information Gathering
- Client-side Testing
- Authentication Testing
- Session Management Testing
- Input Validation Testing
- Business Logic Testing
- Testing for Weak Cryptography
- Identity Management Testing
- Authorization Testing
- API Testing
- Testing for Error Handling
- Configuration and Deployment Management Testing
MSTG
This is a comprehensive guide for mobile app security by OWASP. It covers both Android and iOS apps and provides detailed instructions for testing them which can be used with any testing method including penetration testing. It covers:
- Basic dynamic and static security testing
- Reverse engineering and tampering
- Security testing in the mobile app SDLC
- Mobile platform internals
- Assessing software protections
2. OSSTMM
OSSTMM is another popular framework for penetration testing. It was written in 2001 and has since become a standard among the security industry. It helps with auditing and verifying compliance with government and industry standards. It covers:
- Wireless Security Testing
- Trust Analysis
- Operational Security Metrics
- Compliance Regulations
- Workflow
- Reporting
- Telecommunications Security Testing
- Human Security Testing
- Data Networks Security Testing
- Testing Physical Security
OSSTMM is definitely worth looking into for your next penetration test.
3. NIST
The Cybersecurity Framework (CSF) is published by NIST. It provides guidance on how to conduct penetration tests as part of a larger security assessment. The guide covers five core CSF functions:
- Identify
- Protect
- Detect
- Respond
- Recover
4. ISSAF
ISSAF is aimed at providing guidelines for penetration testing with a focus on the tools that could be used. It is no longer maintained, yet many pen testers still use it. The guide breaks down the process of pen testing into phases. Each phase covers different aspects of the process and is so well structured that it can be used for advanced testing of unique situations. The five phases under ISSAF are:
- Planning
- Assessment
- Treatment
- Accreditation
- Maintenance
The section specifically for penetration testing which comes in phase-II includes:
- Information Gathering (Passive And Active)
- Maintaining Access
- Vulnerability Assessment
- Penetration
- Gaining Access And Privilege Escalation
- Compromising Remote Users/Sites
- Enumerating Further
- Network Mapping
- Covering Up Tracks
ISSAF also has a great section on REPORTING which is often overlooked in other frameworks.
5. PTES
It was developed by the security community to provide a standard methodology for conducting penetration tests. It covers 7 phases:
- Pre-engagement Interactions: This phase includes things such as initial contact, scoping, and requirements gathering.
- Intelligence Gathering: This phase is all about reconnaissance.
- Threat Modelling: In this phase, you will develop a model of the system under attack to identify potential attack vectors.
- Vulnerability Analysis: This is where you will identify vulnerabilities in the system.
- Exploitation: Here, you’ll use exploits to obtain unauthorised access to accounts/systems.
- Post-Exploitation: This phase includes activities such as maintaining access, gathering data, and escalating privileges.
- Reporting: In this phase, you will generate a report of your findings.
The PTES also includes a list of recommended tools and resources, as well as a glossary of terms.
Why Use Penetration Testing Frameworks?
Penetration testing frameworks provide a great starting point for anyone looking to conduct a penetration test. They provide guidance on what to do and what not to do, as well as a list of recommended tools and resources. Using a framework will also help you stay organised and focused during your penetration tests.
Conclusion
There are more than five penetration testing frameworks and each will have something to offer. While some may help you meet compliance requirements others may help you cover more ground during your testing. Having a good understanding of the different frameworks before settling for one would be critical and we hope this article was able to help you with that.
If you’re not sure which framework is right for you, consider hiring a professional security organisation that will be able to help you choose the right framework and conduct your tests using best practices.
Caroline is doing her graduation in IT from the University of South California but keens to work as a freelance blogger. She loves to write on the latest information about IoT, technology, and business. She has innovative ideas and shares her experience with her readers.
