Penetration testing guide

lassification === 'PII' || service?.tags.includes('payment')) { if (severity === 'HIGH') return 'CRITICAL'; }

// De-escalate if WAF is active and blocking known patterns
if (service?.wafEnabled && finding.attackVector === 'KNOWN_PAYLOAD') {
  if (severity === 'MEDIUM') return 'LOW';
}

return severity;

}

private generateRemediationHint(type: string): string { const hints: Record<string, string> = { 'SQLI': 'Use parameterized queries. Review ORM configuration.', 'XSS': 'Implement output encoding. Review Content Security Policy.', 'IDOR': 'Enforce authorization checks on resource access. Verify object ownership.', 'SSRF': 'Validate and whitelist URLs. Block internal metadata endpoints.' }; return hints[type] || 'Review OWASP guidelines for specific remediation.'; } }

// Usage Example const inventory: ServiceInventory[] = [ { endpoint: '/api/v1/users', name: 'User Service', ownerEmail: 'devs@company.com', status: 'ACTIVE', dataClassification: 'PII', wafEnabled: true, tags: [] }, { endpoint: '/api/v1/legacy', name: 'Legacy Gateway', ownerEmail: '', status: 'DEPRECATED', dataClassification: 'INTERNAL', wafEnabled: false, tags: [] } ];

const correlator = new PentestCorrelator(inventory);

const rawFinding: Finding = { targetEndpoint: '/api/v1/users', vulnerabilityType: 'SQLI', cvssScore: 'HIGH', proofOfConcept: "GET /api/v1/users?id=1' OR '1'='1", attackVector: 'KNOWN_PAYLOAD' };

const ticket = correlator.correlate(rawFinding); // Result: Ticket assigned to devs@company.com, escalated to CRITICAL due to PII context.

#### Architecture Decisions

*   **Isolated Test Environments:** Never execute active exploitation against production data. Use ephemeral environments provisioned via Docker/Kubernetes that mirror production configurations but contain sanitized data.
*   **Secrets Management:** Pentest tools require credentials for authenticated testing. Inject secrets via environment variables or a vault (e.g., HashiCorp Vault) during test execution. Never hardcode credentials in scripts.
*   **Rate Limiting:** Configure scanning tools to respect rate limits defined in the Rules of Engagement. Implement exponential backoff to prevent service degradation during testing.

### Pitfall Guide

1.  **Testing Production Without Safeguards:**
    *   *Risk:* Active exploitation can trigger data corruption, service outages, or unintended side effects (e.g., sending test emails to customers).
    *   *Best Practice:* Strictly isolate testing to staging environments. If production testing is unavoidable, implement kill switches, narrow time windows, and real-time monitoring with rollback capabilities.

2.  **Ignoring Business Logic Flaws:**
    *   *Risk:* Automated scanners detect syntax-based vulnerabilities but miss logic errors like privilege escalation, pricing manipulation, or workflow bypass.
    *   *Best Practice:* Dedicate manual testing effort to critical user flows. Map application state machines and test transitions for unauthorized access.

3.  **Over-Reliance on CVSS Scores:**
    *   *Risk:* CVSS measures technical severity but ignores exploitability and business impact. A high CVSS vulnerability may be unexploitable due to network segmentation or mitigating controls.
    *   *Best Practice:* Use contextual risk scoring. Factor in exploit availability, asset value, and existing controls when prioritizing remediation.

4.  **Static Scope in Dynamic Environments:**
    *   *Risk:* Cloud resources spin up and down rapidly. Static scope files quickly become obsolete, leaving new assets untested.
    *   *Best Practice:* Integrate scope definition with CI/CD pipelines. Auto-generate target lists from deployment manifests before each test cycle.

5.  **Poor Remediation Verification:**
    *   *Risk:* Developers apply patches without verifying they resolve the underlying issue. Fixes may introduce regressions or be bypassed by attackers.
    *   *Best Practice:* Implement a re-testing workflow. Automated regression tests should cover previously identified vulnerabilities. Manual verification is required for complex fixes.

6.  **Default Payloads and Signatures:**
    *   *Risk:* Using default tool payloads triggers WAFs and IDS, alerting defenders and skewing results.
    *   *Best Practice:* Customize payloads to bypass basic filters. Use encoding variations and test against the specific WAF ruleset in place.

7.  **Neglecting Third-Party Dependencies:**
    *   *Risk:* Modern applications rely heavily on libraries and APIs. Vulnerabilities in dependencies (Supply Chain) can compromise the entire application.
    *   *Best Practice:* Include Software Bill of Materials (SBOM) analysis in the pentest scope. Verify that dependency updates are applied and that third-party APIs are securely integrated.

### Production Bundle

#### Action Checklist

- [ ] **Define Rules of Engagement:** Document scope, time windows, prohibited techniques, and emergency contacts. Obtain legal and ops approval.
- [ ] **Provision Isolated Environment:** Deploy a test environment with sanitized data and production-equivalent configuration.
- [ ] **Configure Authenticated Access:** Generate service accounts or tokens for testing protected endpoints. Rotate credentials post-test.
- [ ] **Integrate Asset Inventory:** Connect pentest tools to CMDB or IaC state to ensure comprehensive coverage.
- [ ] **Execute Reconnaissance:** Run automated discovery and validate asset list against inventory.
- [ ] **Perform Manual Validation:** Testers verify automated findings and develop PoCs for business logic flaws.
- [ ] **Generate Structured Report:** Output findings in JSON format with severity, context, and remediation hints.
- [ ] **Schedule Remediation Review:** Conduct triage meeting with engineering leads to prioritize fixes based on business risk.

#### Decision Matrix

| Scenario | Recommended Approach | Why | Cost Impact |
|----------|---------------------|-----|-------------|
| **Early-Stage Startup** | Automated DAST + Manual API Review | Low overhead, focuses on critical web/API flaws. Fast feedback loop. | Low |
| **Enterprise Web App** | Integrated Pentest-as-Code + Bug Bounty | Comprehensive coverage, continuous validation, crowd-sourced testing for edge cases. | Medium |
| **High-Risk Financial System** | Red Team Exercise + Formal Pentest | Simulates advanced adversaries, tests detection/response capabilities alongside vulnerabilities. | High |
| **CI/CD Pipeline Integration** | SAST/DAST in Pipeline + Pre-Prod Pentest | Shifts security left, prevents regressions, ensures code quality before deployment. | Medium |

#### Configuration Template

**GitHub Actions Workflow for Automated Pentest Coordination**

```yaml
name: Security Validation Pipeline

on:
  push:
    branches: [main]
  schedule:
    - cron: '0 2 * * 1' # Weekly scan

jobs:
  pentest-coordination:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Code
        uses: actions/checkout@v3

      - name: Provision Test Environment
        run: |
          terraform init
          terraform apply -auto-approve -var="environment=test"
        env:
          TF_VAR_aws_access_key: ${{ secrets.AWS_ACCESS_KEY }}
          TF_VAR_aws_secret_key: ${{ secrets.AWS_SECRET_KEY }}

      - name: Run Authenticated Scan
        uses: owasp/zap-actions@master
        with:
          target: 'https://test-app.company.com'
          token: ${{ secrets.ZAP_TOKEN }}
          cmd_options: '-a -J zap-report.json'

      - name: Correlate Findings
        run: |
          npm install
          node scripts/correlate-findings.js zap-report.json inventory.json > tickets.json
        env:
          JIRA_API_TOKEN: ${{ secrets.JIRA_API_TOKEN }}

      - name: Create Jira Tickets
        run: |
          node scripts/push-to-jira.js tickets.json

      - name: Cleanup Environment
        if: always()
        run: terraform destroy -auto-approve

Quick Start Guide

1. Install Tooling: Set up Burp Suite Professional for manual testing and configure OWASP ZAP for automated scanning. Install the Codcompass security CLI for finding correlation.
2. Configure Scope: Create a scope.yaml file defining target URLs, authentication methods, and excluded paths. Run security-cli validate-scope to check for errors.
3. Run Authenticated Scan: Execute security-cli run-scan --auth-method oauth --token $AUTH_TOKEN. This launches ZAP with authenticated context.
4. Review Findings: Open the generated report in the dashboard. Filter by severity and component. Verify critical findings manually.
5. Create Tickets: Click "Sync to Jira" to push validated findings to your backlog. Assign owners based on service ownership mapping.

Conclusion

Effective penetration testing is not a one-time event but a disciplined engineering practice. By integrating testing into the development lifecycle, automating correlation, and focusing on business context, organizations can transform pentest data into actionable security improvements. Implement the Pentest-as-Code framework to reduce remediation times, eliminate noise, and build a resilient security posture that evolves with your infrastructure.