penetration-testing

Define scope and testing windows first, then follow phases: reconnaissance, vulnerability scanning, manual exploitation of OWASP Top 10 issues, privilege escalation, and documented findings. Each finding needs severity, reproduction steps, and remediation guidance.

Common tools include Nmap for port scanning, Nikto and OWASP ZAP for vulnerability scanning, SQLMap for SQL injection, Burp Suite for request interception, and Metasploit for exploitation. Gobuster handles directory bruteforcing.

Test inputs with payloads like ' OR '1'='1 for authentication bypass, UNION SELECT statements for data extraction, and time-based payloads like SLEEP(5) for blind injection. Automated scanning with SQLMap at risk level 3 covers most cases.

No, penetration testing without written authorization is illegal. Always define scope in writing, test in isolated staging environments first, and never target production or out-of-scope systems without explicit permission.

Severity uses CVSS scoring: Critical (9.0-10.0) for remote code execution, High (7.0-8.9) for SQL injection, Medium (4.0-6.9) for CSRF, and Low (0.1-3.9) for misconfigurations. Scores consider attack vector, complexity, privileges, and impact.

Run automated scans weekly in CI/CD pipelines and manual penetration tests quarterly or after major changes. Critical findings should be fixed within 7 days, high within 30 days, and medium within 90 days, with retesting to verify fixes.