Penetration test procedures do not include

The penetration test step does not include analysis.

1, the definition of penetration test

Penetration testing is an authorization evaluation method to simulate attacks, which is used to check the security of computer systems. Even if the company regularly updates security policies, patches and adopts vulnerability scanners, penetration testing is still needed.

This is because penetration testing can independently check network policies, adding a pair of "eyes" to the system, and most testers are professionals looking for security vulnerabilities. Therefore, penetration testing helps to ensure that network defense works as expected and improve system security.

2. Purpose of penetrant testing

The purpose of penetration testing is to simulate the intrusion system, obtain sensitive information, and organize the intrusion process and details into a report, so that users can understand the security threats existing in the system, remind security administrators to optimize security policies in time and reduce risks.

Even if the system is not breached, professional penetration test can confirm the effectiveness of existing defense measures. Penetration testing can provide a strong basis for improving the scheme by evaluating the security status of the system, thus ensuring network security.

Types of penetration tests

1, network penetration test

Network penetration test includes wireless network penetration test and external network penetration test. Wireless network penetration test is mainly aimed at customer-defined wireless networks, looking for encryption defects and trying to crack the key.

The external network penetration test scans the available vulnerabilities for Internet-oriented assets. In addition, public services that allow login will be affected by password guessing attacks. Internal network penetration test is conducted from the perspective of gaining access to the internal network of an organization.

2. Application of penetrant testing

Application penetration test is divided into Web application penetration test and mobile application penetration test. Web application penetration test pays attention to the attack surface of Web application, evaluates its security and looks for attack methods. Mobile application penetration testing mainly evaluates the security of compiled mobile applications through static or dynamic analysis. In addition, it also includes the analysis and evaluation of the communication process.

3, social engineering attack test

Social engineering attack test mainly includes phishing, telephone voice phishing, USB token injection and SMS collection phishing. These tests are designed to assess the sensitivity of organizational users to spear phishing attacks and their response to fraudulent information. The test results can be used to strengthen the organization's anti-social engineering awareness program.