Pentesting : what should one do if nothing is returned from Vulnerability Assessment

Question

A typicall pentesting activity has the following step :

   1 - information gathering + enumeration
   2 - vulnerability assessment (vulnerability scanning)
   3 - exploitation
   4 - post exploitation (persistence, clearing tracks, etc...)
   5 - report writing

Step 1 to 4 can be a cycle after getting a foothold.

But what do you do if you don't get that foothold. That is, on the iteration, Step 2 (Vulnerability scanning) does not return any vulnerable service nor configuration. If social engineering is not part of the deal, does it mean it's pretty much game over ?

Answer 1

I think your list of steps is flawed. It looks more like this (source):

• Planning & Preparation
• Reconnaissance
• Discovery
• Analyzing information and risks
• Active intrusion attempts
• Final analysis
• Report preparation

Performing a scan on an application is not a penetration test. It is just that, a vulnerability scan. It's very unlikely that you don't see any vulnerabilities. Usually you make a pentest for a reason. There are endless potential attack vectors that a scanner cannot detect. The first thing that comes to my mind are business logic flaws. Also scanners (without complicated manual setup) are not very good at detecting authentication flaws like IDOR. Something a good human pentester will find after the first few minutes of their assessment.

A simple example is the integration of payment providers. I've often seen flaws in the implementation where you could just re-send a specific request in the payment-process, to order the same item over and over again without paying for it. Or you could modify the payment amount. I've even seen webshops where you could recharge gift cards by manually setting the item price to a negative amount. How should a scanner test for that, when it involves third-party components?

Nothing can replace a human pentester.

So the concrete answer to your question is: you analyze all requests and business logic manually, if you couldn't find anything during your automated vulnerability assessment.