Pentest basics
What is penetration testing? A plain guide for software teams
What is penetration testing? What a pentest produces, the main types, how it differs from a vulnerability scan, five phases and one worked example finding.
Short answer
A penetration test is an authorized attempt to break into a system, done by a tester who acts like an attacker. The tester proves which weaknesses are real and shows the impact. You receive a written report with evidence, severity ratings and fix guidance. A scan lists possible issues. A pentest proves which ones can be used.
Penetration testing is an authorized, time-boxed attempt to break into a system. A tester uses the same methods as an attacker to find weaknesses, prove which ones are real, and show what an attacker could reach. The output is a written report that your team can act on.
A pentest needs written permission from the system owner. Without it, the same actions are an attack.
What does a penetration test produce?#
A pentest produces evidence. A good report states each finding, how the tester proved it, how bad it is, and how to fix it. At the end you should hold:
- A scope statement: what was tested, and what was not.
- A list of findings, each with a severity rating.
- Evidence for each finding: requests, responses, screenshots or scripts.
- Steps to reproduce, so your developers can see the problem themselves.
- Fix guidance for each finding.
- A list of controls that held, so you know what worked.
Excession Labs delivers reports in HTML, PDF and Markdown, with proof-of-concept scripts. To check the structure, see a full demonstration report. To use the report, read how to read a penetration testing report.
What are the types of penetration testing?#
The type names the target, and each type needs different skills and tools. The table shows the common types and which ones Excession Labs does.
| Type | Target | Typical issues | Excession Labs |
|---|---|---|---|
| Web application | Sites and web apps | Broken access control, injection, session flaws, business logic | Yes |
| API | REST and GraphQL back ends | Object-level authorization, mass assignment, missing rate limits | Yes |
| SaaS platform | Multi-tenant apps with roles and billing | Tenant isolation, role checks, entitlement bypass | Yes |
| Network | Hosts, ports, internal networks | Open services, weak configuration, lateral movement | No |
| Cloud | Cloud accounts and configuration | Over-broad roles, public storage | No |
| Mobile | iOS and Android apps | Insecure storage, weak transport, exposed keys | No |
| Social engineering | People | Phishing, phone pretexts | No |
Excession Labs tests web apps, APIs and SaaS products. If you need a network, cloud, mobile or social engineering test, ask the provider about those skills before you sign. For the three types we do, read the pages on web application penetration testing, API penetration testing and SaaS penetration testing.
How is a pentest different from a vulnerability scan?#
A scan is automated and broad. A pentest is guided by a person or an agent with a goal, and it proves impact: a scanner reports that something may be wrong, and a tester shows what an attacker can do with it.
| Vulnerability scan | Penetration test | |
|---|---|---|
| Method | Automated checks against known signatures | Manual and tool-assisted testing with judgment |
| Output | List of possible issues | Proven findings with evidence |
| False positives | Common, you must triage | Reduced, each finding is reproduced |
| Business logic | Mostly missed | A main focus |
| Chaining | No | Yes, small issues combined into real impact |
| Typical use | Frequent hygiene checks | Periodic assurance, release checks, customer reviews |
For more depth, read the neutral comparison at pentestcompare.com: pentest vs vulnerability scan.
What are the phases of a penetration test?#
Methods name the steps differently. This page uses five: plan, discover, attack, report and retest. NIST SP 800-115, published in 2008 and still listed as final, describes four phases: planning, discovery, attack and reporting. PTES, a community method last edited in 2014, lists seven sections, from pre-engagement to reporting. Neither is a current requirement, but both are useful models.
- Plan: agree scope, rules, accounts and contacts. You sign the authorization. See rules of engagement.
- Discover: the tester maps the app: pages, endpoints, roles, inputs and technologies.
- Attack: the tester tries to use weaknesses. A good tester also runs controls: requests that should fail, to confirm that protections work.
- Report: the tester writes findings with evidence and fixes.
- Retest: after your team fixes issues, the tester checks each fix. See after the pentest.
The OWASP Web Security Testing Guide is a free, detailed list of web test cases. Testers can use it as a checklist for the discover and attack phases.
A worked example: one finding from start to end#
Demonstration only
This is a demonstration. No real customer system was tested. "Harbor Notes" is a fictional app.
Harbor Notes lets a user open a note at /api/notes/4021. The tester signs in as Alice and opens her own note. The tester then signs in as Bob and requests Alice's note ID with Bob's session.
GET /api/notes/4021 HTTP/1.1
Host: app.example.com
Authorization: Bearer <Bob's token>
The server returns Alice's note. That is a broken object-level authorization flaw. A scanner does not know that note 4021 belongs to Alice, so it does not flag it.
The tester then runs controls. A request for a note ID that does not exist returns 404. A request with no token returns 401. The controls show that the server checks identity but skips the ownership check. The report records the finding, the controls, and the fix: check that the note belongs to the caller before you return it.
When should you get a pentest?#
Get one before launch, before a customer security review, after major changes, and on a regular schedule. The timing depends on how often you ship. Read how often should you pentest for the standards' wording and release triggers.
Also decide how much the tester knows in advance, which changes cost and depth. See black box, grey box and white box testing.
What are the limits of a pentest?#
A pentest shows what a tester found within a scope and a time limit. New code brings new risk after the test ends. A report is not a compliance certificate. If a standard applies to you, ask your auditor what they need.
Need a pentest you can act on?
Tell us what you need tested and why. We reply to agree scope, and testing starts only after written authorization.
Questions
Is penetration testing legal?
It is legal when the system owner gives written authorization first. Testing without that permission can break computer misuse laws. A signed scope and authorization letter protects both sides. Ask a lawyer about your own situation. This page is not legal advice.
How long does a penetration test take?
It depends on scope: the number of apps, roles, API endpoints and integrations. A small web app takes less time than a multi-tenant platform. Your provider should give a duration in the written scope. We do not publish fixed durations.
Will a pentest break my production system?
It can if the tester is careless. Agree the rules first: test accounts, rate limits, forbidden actions and stop conditions. You can test a staging copy or use test-owned data in production. Read the rules of engagement guide for the full list.
Who should run a penetration test?
Use a tester who is independent of the team that built the system. Ask for a sample report, the method, and how findings are proven. Certifications can help but do not replace evidence of real engagement work.
Sources
- NIST SP 800-115: Technical Guide to Information Security Testing and Assessment (2008, final) (checked 9 November 2026)
- OWASP Web Security Testing Guide (checked 9 November 2026)
- PCI SSC Information Supplement: Penetration Testing Guidance v1.1 (2017) (checked 9 November 2026)
- PTES Pre-engagement (Internet Archive capture, 2025-01-03) (checked 9 November 2026)