Penetration testing is also Known as a pencil test. It is used for assessing the security of a computer network or system that suffers from the assault of malicious outsider and insiders. In this procedure, we utilize an active evaluation of this system for any possible vulnerability. The penetration testing is valuable due to following reasons

• It determines the feasibility of a specific pair of attack vectors.
• It identifies the vulnerabilities in the higher to lower arrangement.
• It identifies the vulnerabilities that is not detected by the automatic network or scanning program.
• It provides evidence to support greater investment in private security and technology.

It has several methods to run the testing such as black box testing and white box testing. In black box testing there is no prior knowledge of this infrastructure to be analyzed. It is crucial for the tester to determine the location and extend the system for initiating their investigation. The white box testing provides the entire information concerning the infrastructure to be analyzed and sometime also supplies the network diagrams, source code and IP addressing information.

The penetration testing should Be carried out on any computer that is to be deployed in any hostile environment, in any internet facing website, before the system is deployed. The penetration testing is an invaluable technique for any company for the information security program. Fundamentally white box penetration testing is often ally used as a fully automated inexpensive procedure. The black box penetrating testing is a labor intensive activity that is the reason it is required expertise to decrease the chance of targeted system. The black box penetration testing can slow the business network response time because of network scanning and vulnerability scanning. It is possible that system might be damaged in the course of penetration testing and can be inoperable. This risk might be minimizing by using experienced penetration testers but it cannot be completely removed.

• it is used for the understanding vulnerabilities in Commercial off the Shelf COTS application.
• For the technical vulnerabilities such as URL manipulation, SQL injection, cross-site scripting, backend authentication, password in memory, credential management, etc.
• For knowing business logic mistakes like day-to-day hazard evaluation, unauthorized logins, personnel information alteration, price-list modification, unauthorized fund transfer, etc.

A penetration testing firm does not need to be dangerously close to Your company premises, since some computer security evaluations of this sort could be carried out remotely online. However, for different tests, the tester will require access to your computer systems and so will travel to your place. Whichever company you choose, it is always good practice to institute a programme of standard penetration testing instead of only occasional tests. This manner, unforeseen security vulnerabilities are more likely to be found in good time, before malicious hackers could find and exploit them. This makes it even more important to select Automated Red Teaming sensibly, using the criteria given above.