---
description: Learn the important ethics and methodologies behind every pentest
---

# Pentesting Fundamentals

{% embed url="https://tryhackme.com/room/pentestingfundamentals" %}
[https://tryhackme.com/room/pentestingfundamentals](https://tryhackme.com/room/pentestingfundamentals)
{% endembed %}



| Room Attributes       | Value                                                                   |
| --------------------- | ----------------------------------------------------------------------- |
| Subscription Required |  <mark style="color:green;background-color:green;">False</mark> \[Free] |
| Type                  | Walkthrough                                                             |
| Difficulty            |  <mark style="color:blue;background-color:blue;">Info</mark>            |
| Tags                  | Cybersecurity, Framework, Penetration Testing, Ethics                   |



## Task 1 What is Penetration Testing?

### Read me!

{% hint style="success" %}
No answer needed
{% endhint %}

## Task 2 Penetration Testing Ethics

### You are given permission to perform a security audit on an organisation; what type of hacker would you be?

{% hint style="warning" %}
**HINT:** Look at the hat categories in this task.
{% endhint %}

<details>

<summary>Reveal Flag <span data-gb-custom-inline data-tag="emoji" data-code="1f6a9">🚩</span></summary>

:triangular\_flag\_on\_post:`White Hat`

</details>

### You attack an organisation and steal their data, what type of hacker would you be?

<details>

<summary>Reveal Flag <span data-gb-custom-inline data-tag="emoji" data-code="1f6a9">🚩</span></summary>

:triangular\_flag\_on\_post:`Black Hat`

</details>

### What document defines how a penetration testing engagement should be carried out?

<details>

<summary>Reveal Flag <span data-gb-custom-inline data-tag="emoji" data-code="1f6a9">🚩</span></summary>

:triangular\_flag\_on\_post:`Rules of Engagement`

</details>

## Task 3 Penetration Testing Methodologies

### What stage of penetration testing involves using publicly available information?

<details>

<summary>Reveal Flag <span data-gb-custom-inline data-tag="emoji" data-code="1f6a9">🚩</span></summary>

:triangular\_flag\_on\_post:`Information Gathering`

</details>

### If you wanted to use a framework for pentesting telecommunications, what framework would you use? Note: We're looking for the acronym here and not the full name.

<details>

<summary>Reveal Flag <span data-gb-custom-inline data-tag="emoji" data-code="1f6a9">🚩</span></summary>

:triangular\_flag\_on\_post:`OSSTMM`

</details>

### What framework focuses on the testing of web applications?

<details>

<summary>Reveal Flag <span data-gb-custom-inline data-tag="emoji" data-code="1f6a9">🚩</span></summary>

:triangular\_flag\_on\_post:`OWASP`

</details>



## Task 4 Black box, White box, Grey box Penetration Testing

### You are asked to test an application but are not given access to its source code - what testing process is this?

<details>

<summary>Reveal Flag <span data-gb-custom-inline data-tag="emoji" data-code="1f6a9">🚩</span></summary>

:triangular\_flag\_on\_post:`Black Box`

</details>

### You are asked to test a website, and you are given access to the source code - what testing process is this?

<details>

<summary>Reveal Flag <span data-gb-custom-inline data-tag="emoji" data-code="1f6a9">🚩</span></summary>

:triangular\_flag\_on\_post:`White Box`

</details>



## Task 5 Practical: ACME Penetration Test

### Complete the penetration test engagement against ACME's infrastructure.

<details>

<summary>Reveal Flag <span data-gb-custom-inline data-tag="emoji" data-code="1f6a9">🚩</span></summary>

:triangular\_flag\_on\_post:`THM{PENTEST_COMPLETE}`

</details>

