Talk:Penetration test

message: This page has historically been used to boost vendor credibility by inserting overt or covert references, linking back to a vendor page. Currently there are two examples linking to vendor pages. The two examples below have been added in historically by vendors. One is a link to a vendor's service catalogue, the other to a vendors training courses. Neither are WP:PRIMARY links for the term "security audit". They are simply advertising links to vendor pages. They provide no content to the page and a reader clicking on them is not presented with additional information on the subject, only vendor sales material. These links should be removed entirely, and replaced with a link to the wiki page for "security audit", which does provide additional information useful to the reader. 82.68.2.190 (talk) 09:35, 31 August 2014 (UTC)
thread_title:  External Links Revisited 

message: Disagree It's not right. Web Application Testing is a subset of Penetration Testing. Some examples are internal penetration testing and wireless penetration testing. — Preceding unsigned comment added by 70.122.41.236 (talk) 
I agree. Any means by which someone can gain unauthorized access to a system or confidential information is an exploit. Pen-testing, ideally, should not just examine static open ports and services but do so under operational conditions. Today, an exploit can be temporal, such as a confidential file attachment being sent via a Web-based email client, that would not show up in a conventional static pen-test. —Preceding unsigned comment added by Schratboy (talk • contribs) 
Agree - penetration testing of web applications is definitely a component of penetration testing, and the page isn't big enough to warrant standing on its own. njan 15:27, 22 April 2007 (UTC)
thread_title:  Web Application Testing vs Penetration Testing

message: I think I've cleaned up the links to the point where we can remove that "please clean up external links in this article" header. Any complaints? Random name (talk) 09:13, 2 February 2008 (UTC)
replies: text: I've gone over all the remaining links, formatting those used as reference, removing the rest as promotional. --Ronz (talk) 03:45, 16 August 2008 (UTC)
replies: text: You seem to be treating all external links whatsoever as being "promotional," even when said links are to non-profit organisation providing free copies of the methodologies explicitly discussed in the article. Can you explain this, without simply citing WP:SPAM? I'm tempted to revert some of your edits, but will wait to hear from you. Random name (talk) 07:09, 16 August 2008 (UTC)
replies: text: Actually, I guess I can understand removing the linkfarm. It's a shame, as those really are the best training tools out there, and they were free, but I guess Wikipedia doesn't intend help people in that way - it just wants to hold definitions? I'm still puzzled as to why the links to open source methodologies such as the OSTTM were removed - further to not being a repository of links (useful and free or not), does Wikipedia also simply prohibit linking to discussed material? Random name (talk) 07:18, 16 August 2008 (UTC)
replies: text: "You seem to be treating all external links whatsoever as being 'promotional'" Pretty much, though I should have probably referenced WP:EL rather than WP:SPAM. The links weren't there as references.  They don't belong within the article body.  I don't think they are relevant enough to the article to be moved to and External links section.  See also WP:NOT#LINK.  --Ronz (talk) 01:59, 17 August 2008 (UTC)
replies: text: Ah right - having properly read WP:EL, I can see what you mean. Cheers for the response! Random name (talk) 19:02, 18 August 2008 (UTC)
replies: text: Sorry about the confusion there. --Ronz (talk) 19:17, 18 August 2008 (UTC)
thread_title:  External Links 

message: What is this random methodology supposed to be from?
"Methodology for penetration testing :
   1. port scanning
   2. task to perform for a thorough port scan
   3. system fingerprint
   4. service probing
   5. foot printing"
Is this from one of the methodologies cited in the article? It is something generic which has been made up by various editors? I'd suggest it either needs to be clearly from one of the methodologies discussed, or it needs removing. Alternatively, maybe it just needs to be described as "the key tasks in a pen testing methodology?"  —Preceding unsigned comment added by Random name (talk • contribs) 11:55, 29 February 2008 (UTC)
replies: text: Having had no comments back, I've removed it - the section is meant to discuss formal methodologies, rather than describing a generalised methodology for penetration testing infrastructure. Random name (talk) 23:09, 12 July 2008 (UTC)
thread_title:  Stuff at the end of Methodologies 

message: I'm thinking that the Ethical hack page, or at least whatever content is deemed useful should be merged into here - can't see why there's a separate ethical hack page myself. Any thoughts? Random name (talk) 09:33, 1 May 2009 (UTC)
replies: text: There's no source material I can find on this, appears to be an opinion, which is fine, but not a reason to keep the separate articles. Random name (talk) 19:17, 22 January 2010 (UTC)
thread_title:  Merger proposal 

message: I added the PTF link into methodologies but forgot that I'd added it previously and that it had been removed by User:Random Name. I think the link is useful (as I'm a penetration tester and have used it in the past as a tools reference) but don't want to put it back in if it's been removed and make it look like spamming (FWIW I'm not connected to the PTF). The proposed text would be:
In addition to formal methodologies, other frameworks such as the Penetration Testing Framework provide more detailed (if informal) guidance on typical penetration test processes.
Is that reasonable?  —Preceding unsigned comment added by 78.86.194.239 (talk) 09:49, 23 October 2009 (UTC)
replies: text: Firstly I'd say it's not really a methodology, per se, it's more of a huge collection of links and some tips. A useful resource for testers, but not a methodology. As unintuitive as this might seem, wikipedia is not a collection of useful links, so I don't see a reason to include this. Secondly, I'd note that even if it was a methodology, there's no way it has the noteworthiness of say, OSSTMM. Random name (talk) 08:29, 24 October 2009 (UTC)

text: Agreed. Please see WP:Links before adding what you think are good links. People have been discussing this for several years and have come up with some guidelines of what makes a good link and what doesn't. --Walter Görlitz (talk) 20:55, 18 January 2010 (UTC)
thread_title:  Adding Pen Test Framework Link, Thoughts? 

message: The following entries were removed from the Further reading section:
* Kimberly Graves;  Official Certified Ethical Hacker Review Guide, Sybex Publishing, 2006. 
* Michael Gregg;  Certified Ethical Hacker Exam Prep, Que Publishing, 2006. 
with the comment Removed the two exam-specific books - doesn't seem appropriate, especially the official one. I'm just curious why they are not appropriate? Will add back if no further rationale can be provided. --Walter Görlitz (talk) 01:04, 23 February 2010 (UTC)
replies: text: Sure thing - books being put forward really ought to be "vendor neutral" if you will - I'd no sooner want a SANS guide listed than an CEH book. To be honest, I'm inclined to question whether there is any need for a book section at all; everyone is going to come along and add in their randomly favorite books, authors will drop by and add their own, etc. I'll have a poke around and see if there are any firm guidelines on book lists. In the meantime, I would really suggest that books dedicated to the requirements of particular certifications not be added. Random name (talk) 18:44, 23 February 2010 (UTC)
thread_title: Removing books?

message: penetration testing is very ambigious topic and this page does not really clarify it. Also, certifications list is very out of date. I've been assembling a better list in Template:Computer_Security_Certifications here.
Truekonrads (talk)  —Preceding undated comment added 11:09, 20 May 2010 (UTC)
thread_title:  Quite confusing article and thin on details 

message: Repeatedly reintroducing unsourced content into the article, years after it's been tagged, is a Bad Thing. Either back the content up with a source, or get rid of it. bobrayner (talk) 20:07, 14 December 2012 (UTC)
replies: text: No it's not. There are a great many testing articles that have been tagged for years. Some where it's the whole article. But to oblige you, I'll delete everything that's been tagged since that duration and everything else that should be tagged that hasn't been. Feel free to revert that. --Walter Görlitz (talk) 20:37, 14 December 2012 (UTC)
replies: text:  And While I'm in there, I'll remove all of the self-referenced material since the article has been tagged for that as well. I'll also tag the material that's left with a citation needed as well and then you can come along in eighteen months' time and delete that too. --Walter Görlitz (talk) 20:39, 14 December 2012 (UTC)
replies: text:  So much better. All that unsourced fluff is gone. I trust that this is a much better article now. Thanks for watching over such an important topic. Please raise any further concerns as you have done here. --Walter Görlitz (talk) 20:50, 14 December 2012 (UTC)
thread_title:  Sourcing 

message: I went ahead and added several more certifications in the certification section, including appropriate references. I also added citation information to the section regarding OS Distributions. In doing so, I have also removed the request for references for that particular section. I'll try to find more information as time permits. Aneah|talk to me 14:39, 17 May 2013 (UTC)
thread_title:  Minor Changes 

message: Anon from Sydney . The largest was taking the referenced lede sentence
: A penetration test, occasionally pentest, is a method of evaluating computer and network security by simulating an attack on a computer system or network from external and internal threats
and replacing it with something that is not supported with the reference. Anon refuses to acknowledge how this is not correct and has been edit warring over this. I'm done and would like Sydney to respond or another editor to fix it. Walter Görlitz (talk) 02:28, 16 January 2014 (UTC)
replies: text: I checked on the links of the deleted references, but I see very little value in those. I have to agree with anon, those references are not actually relevant to this article. --K0zka (talk) 15:19, 31 August 2014 (UTC)
thread_title:  Changes from Sydney 

message: ----  
Hello Walter, 
I do understand that you remove the (not wiki standard) comments added recently.
I do not understand how just removing it instead of leaving a (wiki standard) comment about the issue that needs to be resolved?
Copy of comment:
It seems like the term "Penetration test" has been hijacked by commercial organisations. Just like "hacker" has been turned into 
'criminal' by the media and the term "Fresh" is now used by the food industry for processed packaged food. 
"Penetration Testing" used to be used only for white-hat attack simulation, to test how far attackers can gain control, thus only black box, to get a realistic picture of how resilient the target organisation is. This also means that unlike vuln-testing there should be no technical target scope limitation like only defining a IP subnet for testing, but the target is the organisation by any means which a black-hat attacker could also gain access/penetrate. Actual Penetration testing is still the only method available to close the visibility gap between the relative narrow scope standardised(and thus outdated, due to version release cycles) audits and how actual creative attackers use the latest methods to try gain access.
The description below[unreliable source?] seems to be using a mix between pen-testing and vuln-testing(which is not the same as automated vuln-scanning). Penetration tests are often not a component of a full security audit, but requested by IT managers who just want to make a clear point to C-level management that the subject 'Security' needs some budget allocation to give it the needed attention. C-level most often doesn't understand why all those endless vulnerabilities need to be fixed, but do get the message when a report shows how some attacker can actually gain control over systems and data.
Please correct the article below to prevent further protection degradation, due to a false sense of security, by misuse of terminology..''
kind regards, info.at.qcic.nl  — Preceding unsigned comment added by 2001:980:6C7D:4:95FB:81F4:FB26:6A26 (talk) 09:03, 7 September 2015 (UTC)
thread_title:  What is the correct definition of "Penetration testing" ? 

message: The text currently shown in the History section appears to be a direct copy and paste from the Book The Most Indepth Hackers Guide (Dawood Khan). I have flagged the section with the copypaste cleanup tag & would recommend that the section be rewritten and referenced appropriately. Laatu (talk) 02:21, 3 December 2017 (UTC)
replies: text: The book was published 2 December 2015, but I have tracked down the edit to the History section to 4 December 2013.  Since the Wikipedia publication predates the publication of the book by almost 2 years, I assert that Mr. Khan copied from this article, and not the other way around.  In light of that, I suggest removing the copypaste cleanup tag.  For ease of verification, here is a link to the diff: https://en.wikipedia.org/w/index.php?title=Penetration_test&type=revision&diff=584595569&oldid=584565589 Gordon Cook (talk) 15:20, 12 October 2018 (UTC)
replies: text: Looking at the book I could identify more parts which are copy&paste within less than 5 minutes. E.g. "Specifically, PHP introduced an additional control mechanism over remote file include in the form of the allow_url_include switch." is an exact copy of https://de.slideshare.net/Imperva/remote-file-inclusion-rfi-vulnerabilities-101 from 2012. --Shoeper (talk) 08:14, 2 July 2020 (UTC)
thread_title: History

message: I don't think ethical hacking and PT are the same thing. PT is a specific approach to test the security of a network. --Shoeper (talk) 08:01, 2 July 2020 (UTC)
thread_title:  ethical hacking 

message: Penetration testing is not ethical hacking. This needs to be removed from the first sentence. The reference that is cited doesn't even have the phrase "ethical hacking" in the whole article.
2405:6E00:297:67B7:95CB:B91:25AD:816 (talk) 21:26, 31 October 2023 (UTC)
thread_title:  Penetration testing vs ethical hacking