A penetration tester is conducting a black-box test against a web application. During the reconnaissance phase, they discover that the application is running an older version of a popular content management system (CMS) for which several public exploits are available. Which of the following actions is the MOST appropriate next step for the penetration tester, adhering to ethical hacking principles?
- AReport the finding to the client and recommend a patch, then conclude the test.
- BAttempt to exploit a high-impact vulnerability from the known public exploits, within the scope of work.
- CImmediately launch all known exploits against the CMS to gain access.
- DSearch for zero-day vulnerabilities in the CMS to demonstrate advanced capabilities.
Show answer & explanationAnswer & explanation
Correct answer: B. Attempt to exploit a high-impact vulnerability from the known public exploits, within the scope of work.
In a penetration test, the goal is to identify and demonstrate exploitability within the agreed-upon scope. Attempting to exploit known, high-impact vulnerabilities is a key part of this, as it proves the risk. Launching all exploits indiscriminately is reckless, reporting immediately without attempting exploitation misses the point of a pen test, and searching for zero-days is usually out of scope and highly time-consuming for a standard test.
Why the other options are wrong
- A. Reporting without attempting exploitation does not fulfill the 'penetration' aspect of the test.
- C. Indiscriminate exploitation is unprofessional and potentially harmful, violating ethical principles.
- D. Searching for zero-days is typically not part of a standard penetration test scope and is resource-intensive.
Penetration Testing Exploitation Phase
The stage in penetration testing where identified vulnerabilities are actively exploited to gain unauthorized access, elevate privileges, or exfiltrate data, demonstrating the real-world impact of the flaws.
- Always conducted within defined scope and rules of engagement.
- Aims to prove exploitability and impact.
- Requires careful execution to avoid unintended damage.
Memory trick: Exploit with care, then show the scare.