Penetration Testing Tools You Can Use

Pen testing always includes a vulnerability assessment

Penetration testing is all about identifying network security weaknesses before they are exploited internally or externally. The best pen testers bring a range of tools and experience to each gig and a key tool they will use is vulnerability assessment.

The experience level, tools used, findings and the report you get from each penetration test consultant will be different. If you hired 3 consultants to look at the same network, they would produce 3 different reports, highlighting different issues. Ideally they will each find ALL of the high risk vulnerabilities that exist on your network, but this is not a certainty as they will each bring a different set of tools to the job. To overcome this issue of skill variation, some network security teams hire a different consultant each year.

The penetration testing tool every tester uses

Regardless of the variation in skills, procedures and tools used by penetration testers, the primary tool each will depend upon to form the backbone of their network related work product will be a vulnerability assessment scanner. Running a scan on the network to find the vulnerabilities is the first thing they do. They then use other tools to prove that the vulnerabilities exist by attacking them. VA is not the only tool used and penetration testing evaluates many other security factors than just network vulnerabilities, but VA is central.

Every VA solution provider sells to consultants who uses their tools for penetration testing gigs. Our VA solution, Fortra Vulnerability Management, is used by security companies, governments and companies all over the world as part of their penetration testing processes.

Use your own pentest tool to increase security and reduce costs.

Reduce your penetration testing costs by getting your network's high risk vulnerabilities out of the way before the consultant arrives. Whatever VA solution you have, do a complete scan of all hosts prior to the pentest date and get the high risk vulnerabilities fixed. Ideally get the medium risks handled on your highest value hosts. Make your pentester sweat!

If your penetration test turns up network vulnerability risks that your VA solution missed - time for a new solution.

Increase your security by using VA to keep your high risks handled all year. A pentest happens once a year, or perhaps every other year and even if you handle all of the vulnerabilities discovered immediately, one month later new vulnerabilities will have cropped up. Those will remain undiscovered and handled until the next pentest - unless you put in the investment to run your VA solution and fix each weakness as it shows up.

Run VA now, on the entire network, and take action on your vulnerabilities. If your vulnerability assessment solution makes that problematic - also time for a new solution.

Your own penetration testing tool

Fortra VM is a family of vulnerability scanning tools that provides comprehensive testing of your network and web applications regardless of size. At Fortra, we know a lot about security weaknesses. Members of our development team have written books on the subjects of penetration testing, vulnerability assessment, fuzzing, botnets, and more.

This expertise was used to develop what is now Fortra VM. It not only conducts completely automated security that form the basis of many manual penetration tests but also facilitates ongoing network testing to find the countless new vulnerabilities that surface every month. Our solutions are updated with new attack profiles on a daily basis and so frequent testing will reveal new vulnerabilities in existing networks, even when no changes have been made to their equipment or applications.

Run security scans on:

• The corporate LAN and WAN (from within the organization)
• The DMZ and the external network (from the Internet and outside world)
• Operating Systems
• Applications and web applications
• Anything that talks "IP" on a network including VoIP network elements and end-point devices.

Advantages over other scanners and expensive manual penetration testing solutions:

• it is completely automated, freeing security staff to think strategically
• It performs tests without causing any damage - using the same techniques, tools and methodologies as the most sophisticated hackers.
• It consumes minimal bandwidth - there is no negative effect on network performance.
• It performs testing according to your predefined schedule.
• Its data mining capabilities allows on-the-fly generation of statistical and historical information
• It allows you to distribute vulnerability scanning and remediation tasks to multiple stake-holders. This gives each business unit a control panel with access to the functions they need.
• It allows instant tracking of vulnerabilities across networks of any size.
• It generates a detailed network map, detailing what servers and services have been added, removed or changed since the last scan.

Each scan is like a penetration testing tool session that is followed by an extensive network management report. The reports are also a powerful compliance tool for PCI-DSS, SOX, GDPR and HIPAA. Some of the reporting features include:

• Easy to read and understand
• Executive summary and technical sections.
• Links to immediate remedial actions specific to each vulnerability found.
• Differential Reporting that shows just changes in infrastructure (known and unknown) and vulnerabilities from previous scans.