What is penetration testing? It is a simulated cyberattack against a computer system to find exploitable vulnerabilities. It counts as testing only when the system owner has authorised it in writing, and a lab network is the safest place to practise.
This guide explains how a test differs from a scan, how the stages run and how black, grey and white box tests differ. It then walks through a first Nmap scan. For the wider field, start with what is cybersecurity. Certification candidates can continue with the security+ exam vorbereitung hub.
How a penetration test differs from a vulnerability scan
A penetration test goes further than a scan because it tries to exploit weaknesses. Western Governors University describes a penetration test as a simulated cyberattack against a computer system to find exploitable security vulnerabilities. It describes a vulnerability scanner as a tool that evaluates networks, systems and applications for weaknesses that could pose a security risk.
In practice, a scanner produces a list of possible problems. A tester takes that list, or finds problems by other means, and checks which ones an attacker could actually use. A report that says a weakness is exploitable gives a team a firmer basis for deciding what to fix first than a report that only says one may exist.
The stakes explain why organisations pay for this. The same WGU article cites an IBM estimate that U.S. companies lose an average of $4.45 million per data breach. Testing aims to find the exploitable weakness before an attacker does.
Authorisation and legal limits before any scan
Every test starts with written permission from whoever owns the target. A scope document names the systems that may be tested. Rules of engagement set out what the tester may and may not do. Without these, a scan of someone else’s network is an unauthorised probe, not a test.
Legal limits depend on jurisdiction, so anyone based in Germany should confirm the current rules before scanning anything beyond their own equipment. The safest habits for a learner are simple:
- Use only systems you own. A home lab with virtual machines or a spare router gives a realistic target with no third party involved.
- Keep the lab isolated. Point scans at the lab addresses only, never at addresses on a shared or workplace network.
- Get a signature for anything else. A colleague’s or employer’s system needs documented approval that lists the exact addresses in scope.
Phases of a penetration test
A test moves from learning about the target to attacking it and then to reporting. WGU lists five typical stages, and they work as an ordered checklist for planning any engagement:
- Planning and reconnaissance. Define the scope and goals, then gather information about the target.
- Vulnerability assessment. Identify weaknesses that could be used against the target.
- Security breaching. Attempt to exploit those weaknesses to show what an attacker could reach.
- Documentation. Record what was found and how it was reached.
- Remediation. Fix the problems found, so the work ends in improvement and not just a report.
Technical write-ups often split the active work more finely. PurpleSec describes a black box test as moving through reconnaissance, scanning and enumeration, vulnerability discovery, exploitation and privilege escalation. These steps break down the middle of the list above, so they do not replace the planning and reporting at either end.
Black box, grey box and white box testing
The three types differ mainly in how much information the tester receives. Breachlock states that the main difference between each type is the amount of information given to the tester. The choice sets how closely the test imitates a real outsider and how deeply it can examine internals.
| Test type | What the tester receives | Planning use |
|---|---|---|
| Black box | No information about internal workings or architecture, and no credentials beyond what an outsider knows | Suits a view from outside, such as an external attacker probing a public address |
| Grey box | Basic information about the system’s intricacies, architecture and design | Suits a middle path where some insider knowledge speeds up the work |
| White box | Total access to credentials, source code and system architecture | Suits a deep review of internals, such as checking application code |
The descriptions come from WGU and Breachlock.
Black box suits learners who want to practise reconnaissance from nothing, because the only starting point is a target address. White box suits anyone who wants to examine how a system is built. Grey box is a sensible default when the goal is to spend time on weaknesses instead of on guessing the layout. No standards body is cited here, so treat these as common industry usage and check each provider’s own definition in a contract.
A first safe scan with Nmap
Nmap is the usual first tool because reconnaissance depends on it. PurpleSec notes that testers gather early information by scanning the target’s IP address with tools like Nmap. Such a scan usually produces details such as the operating system version and the type of software running.
A cautious first run in a lab follows this order:
- Confirm the target. Check that the address belongs to a virtual machine or device you own and that it sits inside your isolated lab.
- Run a basic scan. Start Nmap from a terminal and give it that single address. Look up the options in the Nmap reference guide before adding any.
- Read the open ports. Each listed port is a service that answers on the network. Note which services and versions are reported.
- Record the result. Write down what was scanned, when, and what was found, as in the documentation stage.
Port coverage affects how complete the picture is. PurpleSec describes a full port scan as covering 1000 of the most popular UDP ports and all 65,535 TCP ports. A scan restricted to a short port list is quicker but can miss services running elsewhere.
An open port is a lead, not a verdict. It shows that something is listening, and the vulnerability assessment stage then decides whether that service is weak. Once Nmap feels comfortable, build a wider tool list around it, adding each tool only when a specific stage calls for it.
Red team and blue team in a training lab
A red team plays the attacker and a blue team defends. A penetration test is mostly red-team work, because the tester behaves like an attacker within agreed limits. The blue team watches systems and responds, which is where monitoring and logging come in. Our guide on what is a siem explains how the logs that defenders rely on are collected and read.
Running both roles in one lab is useful for learning. The attacker sees what a scan reveals, and the defender sees what that scan looks like from the other side.
Frequently asked questions
How often is penetration testing performed?
According to InterVision, penetration testing is typically performed once a year, and some organisations test more often.
How long does a black box test usually take?
PurpleSec says a black box test generally lasts no longer than two weeks.
Is running Nmap the same as a penetration test?
No. Nmap supports the reconnaissance and scanning steps, such as listing open ports and reporting operating system and software details, as PurpleSec describes. A full test also covers exploitation, documentation and remediation.
What information does a white box tester get?
WGU says a white box tester receives total access to credentials, source code and the system architecture.
