A Day in The Life of a Pen Tester

All organizations have vulnerabilities, but they can't fix them until they find them. It's the job of penetration testers to put themselves in an attacker's shoes and find flaws before the bad guys do.

Penetration testing, also known as pen testing, involves testing networks, computer systems, and Web and mobile applications to discover vulnerabilities that could potentially put an organization at risk. Pen tests may simulate human- or technology-based social engineering attacks against an organization's employees to see how people could put a business at risk.

Some companies have penetration testers on their internal security team to test products and systems for vulnerabilities. Many outsource pen testing to consulting or professional services firms, which are staffed with professionals who are trained to break into systems and report back to the client which applications or systems were breached, how they were exploited, and how the organization can mitigate those issues to defend against future cyberattacks.

Security consultant Gisela Hinojosa and security analyst Carlota Bindner are pen testers at Rapid7. The two women are on separate teams under the firm's penetration testing division, and both spend their days on internal and external network penetration testing, mobile and Web application testing, Internet of Things (IoT) testing, and other engagements. "It depends on the type of assessment you're on," says Hinojosa, who has been pen testing at Rapid7 for about three years. 

What does a pen tester's day look like? Mornings are usually pretty busy, she says, as that's when the testing starts. If she's doing an internal pen test, she'll set up the tools she needs and start by collecting open source intelligence (OSINT), which she can use to launch attacks. Hinojosa spends most of the day testing, with occasional meetings throughout the day. The typical engagement lasts about five days but can be shorter or longer depending on the project. 

External pen testing is the practice of testing an organization's externally facing assets. During an external pen test, testers try to access the internal network by exploiting flaws found on external assets. They have to collect intel on open ports, vulnerabilities, and other aspects of the business to launch their attack. Once they're in, they can move on to the internal pen test. External pen tests are more introductory; internal tests involve more detail and complexity.

"That's when we find the most loot," says Hinojosa, who adds internal testing is usually more rewarding because that's when they're trying to gain domain administrative access. "But it's also a lot more work, especially with reporting, because that's when you have the most findings." The amount of required reporting also varies by project, she continues, but they try to start compiling the reports by midweek so as to not leave everything until the last minute.

Bindner, who also spends most of her days testing devices and systems, with meetings throughout, says the flow of her engagements is similar: OSINT, scanning, enumeration, and finding and exploiting vulnerabilities. Internal and client meetings mark the beginning and end of the day, so the client knows when testing has begun and receives an overview of what was found at day's end. "It's to keep them informed throughout the engagement," she explains. 

The process and tools involved depend on what the assessor is breaking into. If they're testing a Web application, for example, they're given a URL to test on. For external networks, they're given IP addresses; for mobile applications, they're given the name of the app to download or the .IPA file if the app hasn't yet been released, Hinojosa says. Mobile testing also requires a jailbroken iOS device or a rooted Android device. IoT testing demands equipment, such as soldering stations to remove chips, and oftentimes debugging hardware and software are required, Bindner adds. Rapid7 has a lab, she says; some testers have their own supplies.

"It's not just about the device sitting alone," she says of the complexities of IoT testing. "It's all the different components it interacts with."

Pen Testing Problems and Perks
One of the frustrations of pen testing is "we are provided a limited amount of time to perform the job we do," Bindner says. Pen testers have to stay within the scope of each engagement, she continues. Sometimes she'll find something she's interested in and want to keep digging deeper, but the limits of the engagement mean they have to move on to finish in time.

On the flip side, Hinojosa says, sometimes clients want to add something to the scope of a project that wasn't agreed on before, which can interfere with the engagement timeline.

Despite frustrations, both women say they enjoy pen testing because "it's like a puzzle you're trying to solve, and it's a challenge," says Hinojosa, a former quality assurance analyst who did software testing for six years before joining Rapid7. She brought her software testing skills to her new role, where she learned from colleagues and was trained on the job to become a pen tester. 

"There's something very rewarding about knowing … while our actions might be those of an attacker's, we're doing it to make sure companies are safer in the long run," says Bindner, whether those actions are getting cross-site scripting on a website or moving from an external network to an internal one. Bindner, who has a degree in animal science, went through the SANS Women's Academy and then trained in Rapid7's security consultant development program.

Both women agree research skills are paramount to succeeding as a pen tester, as there are new vulnerabilities frequently coming out and many different attack scenarios they may not be aware of, Hinojosa says. They're always researching and learning to stay in the loop. It's not just about being able to search something, they agree, but understanding what to look for.

"This field, much like in any other complex field, requires continuous learning," Bindner sayss.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's featured story: "Untangling Third-Party Risk (and Fourth, and Fifth...)."