Security Advanced

What is Penetration Testing?

An authorized simulated cyberattack on a system to evaluate its security defenses and identify vulnerabilities.

Penetration testing (pen testing) mimics real-world attacks to find security weaknesses before malicious actors do. Phases include reconnaissance, scanning, exploitation, post-exploitation, and reporting.

Types include black box (no knowledge), white box (full access), and gray box (partial knowledge). Tools include Metasploit, Burp Suite, Nmap, and OWASP ZAP. Regular pen testing is essential for security compliance and risk management.

Learn More About This Topic

Ethical Hacking & Penetration Testing

Directly covers this topic

SOC Analyst Fundamentals

Related reading

SOC Analyst Advanced: Incident Response & Forensics

Related reading

Related Terms

A one-way function that converts input data into a fixed-size string of characters, used for data integrity and password storage.

A regularly updated list of the ten most critical web application security risks, published by the Open Web Application Security Project.

Practices and mechanisms for protecting APIs from unauthorized access, data breaches, and abuse.

Content Security Policy (CSP)

An HTTP security header that controls which resources a browser is allowed to load for a web page, preventing XSS and data injection.

A technique that controls the number of requests a client can make to a server within a specified time period.

DAST (Dynamic Application Security Testing)

Testing a running application from the outside by sending malicious requests to discover security vulnerabilities.

View All Security Terms →