External network pentest and Application pentest. The same?

Question

I'm trying to create a pentesting process to test the network and applications of a company. I'm using for this the OWASP Testing Guide 4.0, because i do not have experience about pentesting and I do not know nothing better.

The most of steps described on this guide are related with application testing. I understood that this is because the most used way for try to acces to the systems of the company is the application hacking and then the corresponding elevation of privileges.

So, can we say the external pentest and application pentest are the same or have the same objetive?

Thank you for all.

Answer 1

In short, no, they are not the same.

OWASP stands for open web application security project, which is why its guide is focused on the application side of things. You might find what you're looking for here:

http://www.pentest-standard.org/index.php/PTES_Technical_Guidelines

However, conducting pentests is best left for professionals - they will be more efficient and will be able to interpret the results correctly.

Answer 2

Conducting the test yourself will give you a lot of information on what to look for in a pentest report. However, as someone said I would highly recommend having your web app tested by a professional.

You may consider creating a test user for authenticated test cases. OWASP and manual testing would give a more comprehensive report. Consider Gray box test[Grey Box Penetration Testing: In this approach, the tester has limited details about the target environment. It is a simulation of external security attack.]

Hope you find this helpful.

Answer 3

As a general rule no they are not the same, but there's often a little overlap and this is going to depend on the consulting firm and how they scope out the engagement or the client and the specific business need. I've been a consultant / pentester for years and most of the time external pentests and application pentests are different or at least separately undertaken to ensure a deep dive discovery.

I can understand where the confusion can come into play since both assessment types can be externally facing but generally a network pentest is going to focus on the underlying infrastructure and bypassing your perimeter defenses. It may leverage a an application for information or to be used for exploitation but that is not the sole purpose. Focuses may include password attacks, weaknesses in firewall/IDS/VPN, insecure/exposed services, authentication attacks, access to sensitive systems etc...

Application assessments focus on compromising the application itself. It's a deeper dive into the actual applications workings and may include code analysis, authentication bypasses, privilege escalation, injection (SQL injection, XSS, etc...), API testing, database testing, mobile app testing, and subverting application logic.