How penetration are tests usually conducted? I am learning some testing techniques like XSS, SQLi, Path traversal, etc. In each technique, there are many different possibilities, where only one might work. I can't imagine how long the test would take for a web application when I should try all possibilities.

Is it enough to rely on some scanners? For example, for SQL injection, I will use SQLmap. If it doesn’t find anything, is there a low probability that an injection is still possible somewhere?

  • There are pentesting methodologies and frameworks to guide the process.
    – schroeder
    Commented May 9 at 10:48
  • How long do you think a pentest of an app should be?
    – schroeder
    Commented May 9 at 10:53
  • @schroeder I know there are different methodologies (e.g. OWASP), but I think they don't answer my question. I just want to know how testing, for example, for SQL injection, is performed if I have a web application with many input fields. As I said, there are a lot of possibilities, and testing all fields with all combinations is unimaginable. And that's just for SQL injection. Commented May 9 at 11:08
  • 2
    In most assignments, there is a timeframe for completing the test, which means you have to choose your angle carefully, and you'll not have time to test every possible attack. Experience and instinct will help here. For example, if you can identify the database, then you can tell SQLmap to focus on that particular DB and skip the tests applying to other DBs, that are not relevant and a waste of time. Then, you automate as much as you can. If there is a WAF in place, this will make the test more difficult. Do reconnaissance first then figure out what can be done.
    – Kate
    Commented May 9 at 17:41

1 Answer 1


In my experience, a pentest on a web application takes between one or two weeks.

A pentest typically does not claim to find all the vulnerabilities. If an application is vulnerable for a specific vulnerability such as XSS or CSRF, it is often vulnerable throughout the application. Typically, I don't test all URLs for all vulnerabilities. When I find XSS in a few places, I stop searching for XSS and focus on other vulnerabilities. In the report I will describe that this vulnerability may be present in other places. If a vulnerability is only present on one URL or in a specific edge case, I will probably not find it.

Is it enough to rely on some scanners?

I would say using scanners in a pentest is necessary but not sufficient.

During a pentest I often use the Burp active scanner. This is an easy way to find some vulnerabilities. It also can't find many vulnerabilities, so it's not sufficient to rely on.

Sqlmap is pretty good, but I have seen SQL injections that sqlmap couldn't identify.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .