What is Automated Penetration Testing

Automated penetration testing differs from regular penetration testing by utilising a set of tools and services that continuously test applications to identify and exploit both new and old vulnerabilities. Most tools available in the cloud and application security space have some level of automation, with some tools operating entirely automatically, requiring a small number of initial commands and configuration. These automated tools handle various components of the testing process, such as discovery, identification, scanning, and simulated attacks.

Tools vs Process ¶

When discussing “automation” we split the concept between “automated tools” and “end to end automation”. Automated tools are common and work within a narrow and focused scope to tackle specific problems. End to End automation covers the full process of continually testing and reacting to vulnerabilities and threats as a core operating function of an organisation.

Whilst individual tools are automated with little input, the overall penetration testing process is often not automated, with only a few select services providing a full end to end service in a particular technology segment such as web or cloud penetration testing. To understand why this is the case lets start by looking at an example tool with high levels of automation.

An Automated Tool Example ¶

Let’s use Nuclei as an example. Nuclei is an automated testing tool that forms part of a suite of tools used for identification, discovery and analysis. While Nuclei does not cover the initial discovery of assets, the infrastructure testing, or other key security concerns, it does offer many automation features for penetration testing of HTTP based web applications. All Nuclei needs is a URL to target and it’ll start to analyse the type of software present and apply the appropriate automated tests to identify vulnerabilities. It’s an excellent tool that we use as needed.

Within this remit Nuclei is fantastic. However, it’s important to note that finding the URL to scan and managing the data Nuclei produces cannot be built into the scope of this one tool. Outside of Nuclei’s scans there’s a need to provide critical operations such as:

• Discovery of assets and services for testing
• Identification of infrastructure based vulnerabilities, misconfigurations, and improvements
• Crawling services for mapping and discovery
• Report and document generation
• Metrics tracking over time
• Integration with Information Security Management Systems and Governance
• Architectural advisory and resolution guidance

It’s logical that Nuclei does not offer these features because each of these areas requires a high level of specificity and customisation within an organisation. It’s important for each organisation to compile and customise these tools according to their needs, aligning them with their overall information security management system to protect their data, confidentiality, integrity, and assets.

With this in mind, Nuclei is excellent as a standalone tool, to be incorporated into a process by skilled penetration testers as needed. In this role, it excels. Comprehensive, fully automated penetration testing tools to perform all parts of the security workflow are rare given the sheer scope of a full end to end testing service.

An Automated Process Example ¶

At SkySiege, we provide a complete service for Cloud Penetration Testing. Doing this required custom development of our own software covering areas like document generation, reporting and governance integration, making the information provided by tools usable for an organisation. Some of the elements we have developed in-house include:

• A machine-readable architectural design repository
• Dynamic content censoring options
• An IP-to-human location explanation tool
• Network classification logic to determine internet accessibility
• CWE logic catalogue
• A secure resource scanning tool

Get in touch! ¶

While automated penetration testing tools are readily available, comprehensive services that integrate all these functionalities into a full, end-to-end automated system are rare. This rarity is due to the expertise, knowledge, and experience needed to determine and manage an organisation’s overall security posture, considering factors such as size, scope, responsibility, and process. The tools themselves are simply tools; the strategy and organisation behind choosing and using these tools are far more complex to develop.

The good news is that end to end penetration testing is what we do! We’re one of those rare services providing the full end to end process with full automation for discovery, identification and reporting. If you need help with this get in contact with the link below!