Penetration testing guide

Authenticated Scanning Integration: Configure tools to use service accounts or OAuth tokens for authenticated testing. Unauthenticated scans miss 60% of vulnerabilities in modern web applications. 4. Manual Validation & PoC Generation: Testers verify automated findings and develop custom PoCs for business logic flaws. PoCs must include reproduction steps, HTTP requests, and impact analysis. 5. Remediation Ticket Automation: Parse test results into structured JSON and push findings to Jira/GitHub Issues with severity, affected component, and remediation suggestions.

Code Example: Finding Correlation Engine

The following TypeScript utility demonstrates how to correlate pentest findings with internal service ownership, reducing noise and directing tickets to the correct teams.

import { Finding, ServiceInventory, RemediationTicket } from './types';

class PentestCorrelator {
  private inventory: Map<string, ServiceInventory>;

  constructor(inventory: ServiceInventory[]) {
    this.inventory = new Map(inventory.map(s => [s.endpoint, s]));
  }

  /**
   * Correlates a raw pentest finding with service metadata.
   * Filters out findings for deprecated services.
   */
  public correlate(finding: Finding): RemediationTicket | null {
    const service = this.inventory.get(finding.targetEndpoint);

    // Skip findings for deprecated or decommissioned services
    if (service?.status === 'DEPRECATED') {
      console.log(`Skipping finding for deprecated service: ${finding.targetEndpoint}`);
      return null;
    }

    // Enrich finding with service context
    const ticket: RemediationTicket = {
      id: crypto.randomUUID(),
      summary: finding.vulnerabilityType,
      severity: this.calculateContextualSeverity(finding, service),
      assignee: service?.ownerEmail || 'security-team@company.com',
      component: service?.name,
      evidence: finding.proofOfConcept,
      remediation: this.generateRemediationHint(finding.vulnerabilityType),
      source: 'pentest-engine',
      createdAt: new Date().toISOString()
    };

    return ticket;
  }

  private calculateContextualSeverity(finding: Finding, service?: ServiceInventory): string {
    let severity = finding.cvssScore;

    // Escalate if service handles PII or payments
    if (service?.dataClassification === 'PII' || service?.tags.includes('payment')) {
      if (severity === 'HIGH') return 'CRITICAL';
    }

    // De-escalate if WAF is active and blocking known patterns
    if (service?.wafEnabled && finding.attackVector === 'KNOWN_PAYLOAD') {
      if (severity === 'MEDIUM') return 'LOW';
    }

    return severity;
  }

  private generateRemediationHint(type: string): string {
    const hints: Record<string, string> = {
      'SQLI': 'Use parameterized queries. Review ORM configuration.',
      'XSS': 'Implement output encoding. Review Content Security Policy.',
      'IDOR': 'Enforce authorization checks on resource access. Verify object ownership.',
      'SSRF': 'Validate and whitelist URLs. Block internal metadata endpoints.'
    };
    return hints[type] || 'Review OWASP guidelines for specific remediation.';
  }
}

// Usage Example
const inventory: ServiceInventory[] = [
  { endpoint: '/api/v1/users', name: 'User Service', ownerEmail: 'devs@company.com', status: 'ACTIVE', dataClassification: 'PII', wafEnabled: true, tags: [] },
  { endpoint: '/api/v1/legacy', name: 'Legacy Gateway', ownerEmail: '', status: 'DEPRECATED', dataClassification: 'INTERNAL', wafEnabled: false, tags: [] }
];

const correlator = new PentestCorrelator(inventory);

const rawFinding: Finding = {
  targetEndpoint: '/api/v1/users',
  vulnerabilityType: 'SQLI',
  cvssScore: 'HIGH',
  proofOfConcept: "GET /api/v1/users?id=1' OR '1'='1",
  attackVector: 'KNOWN_PAYLOAD'
};

const ticket = correlator.correlate(rawFinding);
// Result: Ticket assigned to devs@company.com, escalated to CRITICAL due to PII context.

Architecture Decisions

• Isolated Test Environments: Never execute active exploitation against production data. Use ephemeral environments provisioned via Docker/Kubernetes that mirror production configurations but contain sanitized data.
• Secrets Management: Pentest tools require credentials for authenticated testing. Inject secrets via environment variables or a vault (e.g., HashiCorp Vault) during test execution. Never hardcode credentials in scripts.
• Rate Limiting: Configure scanning tools to respect rate limits defined in the Rules of Engagement. Implement exponential backoff to prevent service degradation during testing.

Pitfall Guide

1. Testing Production Without Safeguards:

   • Risk: Active exploitation can trigger data corruption, service outages, or unintended side effects (e.g., sending test emails to customers).
   • Best Practice: Strictly isolate testing to staging environments. If production testing is unavoidable, implement kill switches, narrow time windows, and real-time monitoring with rollback capabilities.

2. Ignoring Business Logic Flaws:

   • Risk: Automated scanners detect syntax-based vulnerabilities but miss logic errors like privilege escalation, pricing manipulation, or workflow bypass.
   • Best Practice: Dedicate manual testing effort to critical user flows. Map application state machines and test transitions for unauthorized access.

3. Over-Reliance on CVSS Scores:

   • Risk: CVSS measures technical severity but ignores exploitability and business impact. A high CVSS vulnerability may be unexploitable due to network segmentation or mitigating controls.
   • Best Practice: Use contextual risk scoring. Factor in exploit availability, asset value, and existing controls when prioritizing remediation.

4. Static Scope in Dynamic Environments:

   • Risk: Cloud resources spin up and down rapidly. Static scope files quickly become obsolete, leaving new assets untested.
   • Best Practice: Integrate scope definition with CI/CD pipelines. Auto-generate target lists from deployment manifests before each test cycle.

5. Poor Remediation Verification:

   • Risk: Developers apply patches without verifying they resolve the underlying issue. Fixes may introduce regressions or be bypassed by attackers.
   • Best Practice: Implement a re-testing workflow. Automated regression tests should cover previously identified vulnerabilities. Manual verification is required for complex fixes.

6. Default Payloads and Signatures:

   • Risk: Using default tool payloads triggers WAFs and IDS, alerting defenders and skewing results.
   • Best Practice: Customize payloads to bypass basic filters. Use encoding variations and test against the specific WAF ruleset in place.

7. Neglecting Third-Party Dependencies:

   • Risk: Modern applications rely heavily on libraries and APIs. Vulnerabilities in dependencies (Supply Chain) can compromise the entire application.
   • Best Practice: Include Software Bill of Materials (SBOM) analysis in the pentest scope. Verify that dependency updates are applied and that third-party APIs are securely integrated.

Production Bundle

Action Checklist

• Define Rules of Engagement: Document scope, time windows, prohibited techniques, and emergency contacts. Obtain legal and ops approval.
• Provision Isolated Environment: Deploy a test environment with sanitized data and production-equivalent configuration.
• Configure Authenticated Access: Generate service accounts or tokens for testing protected endpoints. Rotate credentials post-test.
• Integrate Asset Inventory: Connect pentest tools to CMDB or IaC state to ensure comprehensive coverage.
• Execute Reconnaissance: Run automated discovery and validate asset list against inventory.
• Perform Manual Validation: Testers verify automated findings and develop PoCs for business logic flaws.
• Generate Structured Report: Output findings in JSON format with severity, context, and remediation hints.
• Schedule Remediation Review: Conduct triage meeting with engineering leads to prioritize fixes based on business risk.

Decision Matrix

Scenario	Recommended Approach	Why	Cost Impact
Early-Stage Startup	Automated DAST + Manual API Review	Low overhead, focuses on critical web/API flaws. Fast feedback loop.	Low
Enterprise Web App	Integrated Pentest-as-Code + Bug Bounty	Comprehensive coverage, continuous validation, crowd-sourced testing for edge cases.	Medium
High-Risk Financial System	Red Team Exercise + Formal Pentest	Simulates advanced adversaries, tests detection/response capabilities alongside vulnerabilities.	High
CI/CD Pipeline Integration	SAST/DAST in Pipeline + Pre-Prod Pentest	Shifts security left, prevents regressions, ensures code quality before deployment.	Medium

Configuration Template

GitHub Actions Workflow for Automated Pentest Coordination

name: Security Validation Pipeline

on:
  push:
    branches: [main]
  schedule:
    - cron: '0 2 * * 1' # Weekly scan

jobs:
  pentest-coordination:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Code
        uses: actions/checkout@v3

      - name: Provision Test Environment
        run: |
          terraform init
          terraform apply -auto-approve -var="environment=test"
        env:
          TF_VAR_aws_access_key: ${{ secrets.AWS_ACCESS_KEY }}
          TF_VAR_aws_secret_key: ${{ secrets.AWS_SECRET_KEY }}

      - name: Run Authenticated Scan
        uses: owasp/zap-actions@master
        with:
          target: 'https://test-app.company.com'
          token: ${{ secrets.ZAP_TOKEN }}
          cmd_options: '-a -J zap-report.json'

      - name: Correlate Findings
        run: |
          npm install
          node scripts/correlate-findings.js zap-report.json inventory.json > tickets.json
        env:
          JIRA_API_TOKEN: ${{ secrets.JIRA_API_TOKEN }}

      - name: Create Jira Tickets
        run: |
          node scripts/push-to-jira.js tickets.json

      - name: Cleanup Environment
        if: always()
        run: terraform destroy -auto-approve

Quick Start Guide

1. Install Tooling: Set up Burp Suite Professional for manual testing and configure OWASP ZAP for automated scanning. Install the Codcompass security CLI for finding correlation.
2. Configure Scope: Create a scope.yaml file defining target URLs, authentication methods, and excluded paths. Run security-cli validate-scope to check for errors.
3. Run Authenticated Scan: Execute security-cli run-scan --auth-method oauth --token $AUTH_TOKEN. This launches ZAP with authenticated context.
4. Review Findings: Open the generated report in the dashboard. Filter by severity and component. Verify critical findings manually.
5. Create Tickets: Click "Sync to Jira" to push validated findings to your backlog. Assign owners based on service ownership mapping.

---

Conclusion

Effective penetration testing is not a one-time event but a disciplined engineering practice. By integrating testing into the development lifecycle, automating correlation, and focusing on business context, organizations can transform pentest data into actionable security improvements. Implement the Pentest-as-Code framework to reduce remediation times, eliminate noise, and build a resilient security posture that evolves with your infrastructure.