Penetration testing
Penetration testing is an authorized assessment that attempts to exploit weaknesses in a defined system, application, or environment to establish what an attacker could do within the agreed scope.
Find out whether a weakness can be used
A scanner may flag a possible vulnerability. A penetration tester investigates whether it can actually be exploited and what access it provides. Several individually limited weaknesses can sometimes combine into a more serious path.
NIST SP 800-115 describes that progression from discovery to attempted exploitation. OWASP’s Web Security Testing Guide provides a more application-focused testing reference. Neither makes every engagement identical: the agreed targets, starting access, permitted techniques, and time available shape what gets tested.
Read the scope before the headline result
A test of an internet-facing application does not automatically include the company’s help desk, internal network, or cloud administration. Social engineering and other additional activities belong in the agreed scope when they are relevant.
A supplied test account also changes the question. It can help determine whether one user can read another user’s records, but it does not establish how an attacker would obtain the account. The technical follow-on guide explains how to keep supplied access separate from access demonstrated during an exercise.
A red-team exercise may pursue a broader adversary objective and examine defensive response along the way. A penetration test usually concentrates on finding and demonstrating exploitable weaknesses in its target. The work can overlap; the engagement plan matters more than the label.
Use the results to fix the demonstrated weaknesses and retest the relevant paths. Finding no exploitable issue in a bounded assessment does not prove that none exists.