The principles of testing.
So we can directly just dive into technical details for this cause it's going to be quick and fun,
but to add even greater value to testing experience, you're going to need more.
You're going to need to know how to do the right things.
A Web tester needs to look widely at the testing process, broaden your perspective, so it's also a
good skill for when you go into a job interview, right?
So in other words, if you're going to lead a pen test, you really do need to understand why you do
what you're going to do.
You understand what I'm talking about.
So.
Let's get up to speed with these rules or principles.
And you'll know what I mean.
Define the scope of security.
So the scope of security is not exactly the same as the scope of the test.
The scope of security helps you define how you will behave once you obtain some data and how much further
you go within a test.
Although there are some specific legal issues within the scope of security, I want to give you some
important information for the technical part.
So it's important to know why you are doing this test, will it be part of an ISO 27 one process or
will it be done under a regulation or directive?
That needs to be clarified.
Because sometimes the way you conduct a penetration test varies due to a particular regulation.
It's even going to affect your reports, for example, the European Union Data Protection Directive
defines how you should treat personal data.
Use the right tools.
Tools, of course, play a critical role and penetration testing.
And after you gain more experience, you'll be able to have your own toolkits or scripts.
But you first need to start with the tools that are already in the market.
There are many open source and commercial tools that you can use to conduct a pen test, but the point
is here, tools have some limitations, so under certain circumstances, they may not work.
So you need to direct and rule the tool.
Thinking out of the box.
I know I might talk a little too much about rules and orders, don't want to kill your creativity while
testing, but it's not going to.
So you know that you have to follow certain rules, but you also need to have your own unique approach.
So in addition to normal use cases going beyond what's expected by a developer or the owner of the application,
that's important.
Another key here for creativity is.
Simulating the behavior of a hacker and thinking strategically so that you can even go beyond with that
hacker is capable of.
Focus on the details.
And try to know everything you get about the application.
You can combine this information to do some extra attacks.
And if it is allowed by the scope, don't even hesitate to manipulate all the data between you and the
server.
OK, so there is no silver bullet.
Security is a process and not a product.
So an application can gradually be secure.
But when you do a test, you should try to look at every aspect of the application.
But you still might be able to miss a few points.
Report the findings.
So after you conclude the test, it's time to show your reporting skills.
Now, some testers fail at this phase because of their lack of writing skills.
And, you know, I'm sorry, but it's no excuse if you want to accomplish the goal of being a pen tester.
Of course, there will be some vital rules.
In reporting, first of all, you were your findings should be reproducible.
What if, you know, they hire another pen tester?
Can the other pen tester easily follow your way and your method and validate the result?
Replicable data.
Your report should also target all concerned parties such as developers, executives, the IT department
and so on and so forth.
Now I prepare at least two reports, one for the tech guys who will solve the problems and then the
other one for the executive or the business owners to help them understand what's going on in their
system.
The executive report should not include overly technical details, and it should be short and impressive
so that it forces them to take this seriously.
Now, both reports should clearly point out what you did with your associated recommendations for resolving
their issues.