I am doing a study in school for computer science. My research topic is pen testing, since that is what I hope to do after I graduate. While doing research I am finding things that can go wrong, but I don't know how frequently each problem is encountered.

Edit: I am very new to the subject so I hate to say my knowledge is limited. The subjects that sound the most interesting to me are OS, networking, and social engineering (but I think that is a different can of worms.)

  • 5
    You need to define your question more: what kind of pen testing? Are you aware of the OWASP Top 10?
    – schroeder
    Commented Sep 17, 2015 at 16:42
  • A google search with your subject line will give some in-depth useful answers including the "Schneier on Security" blog and possibly irmsecurity.com/blog/… Commented Sep 17, 2015 at 16:54
  • OS, networking, and social engineering cover an immense area of study. I'm afraid that you will have to narrow it down before we can hope to answer your question.
    – schroeder
    Commented Sep 17, 2015 at 17:48
  • BTW, once you narrow it down, you will be able to find the "most common" problems on your own. First rule of research: have a well-defined question.
    – schroeder
    Commented Sep 17, 2015 at 17:50

2 Answers 2


A general strategy and list of issues was spoken about in this thread -- https://security.stackexchange.com/a/68666/140

You should check out the MITRE CAPEC work. In 2015, colleagues and I have been seeing a lot of web-layer command injection or varietals of command injection, such as spoken about in Andrew Wilson's (of Bishop Fox) Toorcon talk, "if you like it then you shouldn't put a ring3 on it". For mobile apps: unobfuscated keys, static passwords, or other static configurables are common. When performing social engineering, the most common vector is local Administrator account privilege escalation to a Microsoft Forest and associated domains, as seen in Matt Weeks' (of root9b) talk at CanSecWest on "Credential Assessment: Mapping Privilege Escalation at Scale".

If you want to take a look under the hood, I recommend that you acquire the following toolchains:

  1. For remote-command injection, get a license for Burp Suite Professional and leverage the metasploit-framework with tools such as sqlmap, NoSQLMap, commix, and liffy.
  2. For mobile app penetration testing, check out the BLACKBUCK, idb, Lobotomy, and dtf toolsets, as well as Frida (and analogues or prerequisites to those such as adb, lldb, Xcode, usbmuxd, multcprelay, cycript, Drozer, Xposed framework, libimobiledevice, otool, optool, Android emulator strace, kdv, iosbinpack, et al).
  3. For attacks against Microsoft Forests, be sure to check out the tools from Adaptive Red Team Tactics such as PowerSploit, Empire, Veil / PowerTools, ntlmv2_capture_hashcheck, root9b Orkos, FuzzLabs, Immunity Security ImmDbg, INNUENDO, CANVAS, and Cobalt Strike.

"Pen testing" is a broad topic with many specializations. You may be testing networks, deployed applications, hardware, or even operating systems.

Application pen testing itself can vary to testing command line, GUI, client, server, client/server, mobile, embedded, web service(s). Each variation comes with its own common set of issues that are encountered "in the wild". If you are interested in seeing the types of issues that are encountered an excellent starting point is The Community-Developed Dictionary of Software Weakness Types.

Not the answer you're looking for? Browse other questions tagged .