# A Systematic Literature Review on Penetration Testing in Networks: Future Research Directions
## 3 Literature Review
### Detecting Open Ports and Possible Attacks  
The purpose of the study by [PERSON] et al. [1] was to provide an overview of penetration testing for the novice penetration tester. In this way, the tester could identify the security vulnerability and make perfect recommendations to improve security and maintain the system. It was outlined that penetration testing has five phases, namely reconnaissance, scanning, gaining access, access maintenance, and report generation. It was also outlined that the methods of penetration testing are external testing, internal testing, blind testing, double blind testing, and targeted testing. Finally, some tools for penetration testing, such as Nmap, Shadow, Brup Suite, Metaspoilt, and Wireshark, were presented in detail. The purpose of the study by [PERSON], [PERSON] et al. [3] was to propose a scanning strategy using the Nmap tool. This strategy illustrated how penetration testing deals with large sets of hosts. Initially, an IP table was used to monitor traffic sent to a given host before  
Figure 3: Network penetration testing. 1000 TCP popular ports were scanned on a host using Nmap tools. Then, network sweeping techniques were used, i.e., Nmap network sweeping scan with the -sn parameter, which used ICMP packets to scan hosts in the network. In addition, five timing options were used to control the scan time. The result showed that the fifth option required less scan time. This means that it needs to discover additional ports and services by using a more comprehensive scan and performing port scans blindly to open ports that make the security assessment more effective. The purpose of the study by [PERSON] et al. [4] was to provide an overview of network penetration testing. The study illustrated all of the mechanisms of network penetration testing, including information gathering and subsequent exploitation. It also discussed the methodology of network penetration testing, which is divided into five steps. Prior to conducting a network penetration test, the tester must connect to the network LAN and perform an ARP ping scan to bypass the policy list and find the IP address. The test begins by collecting information such as the address of internal network sources (i.e., the IP address using the Google database, social media, and the company website). Then, in the scanning phase, tools, such as Nmap and Nessus, are used to find the hosts, ports, and running services to detect vulnerabilities. This is followed by enumeration and post-exploitation, and finally reporting. The study recommended performing network penetration tests to protect the company's IT data. The purpose of the study by [PERSON], [PERSON] et al. [6] was to protect against various cyber attacks. The paper illustrated the vulnerability assessment and penetration testing (VAPT) of the life cycle. It starts in the area where an attacker tries to obtain information about the victim, i.e., the victim's operating system. Then, the reconnaissance phase begins, and the security auditor gathers all of the information about the device or system. This data helps the security tester to plan the attack methods for the system. Then, in the vulnerability detection phase, the tester tries to find vulnerabilities in the system/device. In the information analysis and planning phase, the tester analyzes the risk identified during scanning to determine the cause and effect of the risk that will occur after the victim is exploited. The penetration phase (exploiting) focuses on external real risks. Privilege escalation is performed after penetration to identify and gain higher privileges. In the results analysis phase, recommendations are planned to address the risk or defect. Finally, in the reporting and clean-up phase, a report is created and executed to remove the temporary files and restore the system to its original state. This paper also introduced the network security assessment tools such as Wire Shark, Nmap, Metasploit, and Air Crack.