Do ISP Detect and Block Pen Testing Tools?

Question

I one of the earliest books I read on security - The Basics of Hacking and Penetration Testing (978-0124116443); the author emphasized that you cannot use these Penetration Test Tools over the internet as some of the ISPs monitor the use of such tools and will block access to your internet if they feel you are using such tools.

If this is true - this is a gem of an advise. But the reason I am questioning this is because in no other book I read was this even casually mentioned. So my questions are,

• Is this advise correct? Will someone have his/her internet connection blocked for using pentesting tools over the internet (with authorization from the website owner)?
• Are there any workarounds - like running the remote pen test from say a cloud host?

Answer 1

First of all, there is a difference between performing a penetration test and an automated scan (low hanging fruits) where automated scans generate a lot of traffic.

Then there is a difference between infrastructure and (web) application penetration tests and then it depends on the type of test:

• Black Box
• Grey Box
• White Box

Infrastructure Penetration Tests

For infrastructure penetration tests I can see where a Black Box PT might get you in trouble with your ISP. In my opinion, you should never recommend to this type of test to your clients because you might not get anything out of it.

While with a Grey or White Box approach you can analyse what an attacker could have done if no information was given (e.g. Black Box approach)

Application Penetration Tests

For (web) application penetration tests, this is done manually, which means this should be considered "normal" traffic. If an ISP would block your connection, chances are they're using DPI (Deep Packet Inspection) but this is considered illegal in some countries.

I have performed hundreds of penetration tests from my home internet connection and I have never ever been warned or blocked by my ISP. (Even when performing automated scanning tools such as Nessus and Acunetix)

So all in all, I think penetration tests can be executed without getting blocked, but that's from my own experience.

Answer 2

most ISPs will have some security measures to protect their own infrastructure(mostly OSI L3, L2 devices and DNS stuff)

so, if your pen testing involves these above infrastructure, there is a good chance that the ISP will notice it.

The best workaround is the one by @schroeder♦ - use a VPN.

Answer 3

I've indeed crossed this advice in a few other books as well, but this was more a legal than a technical advice.

If you are using a personal internet access (enterprise offers are less likely to be shut down by the ISP), and / or if you did not take the proper legal measure around your penetration testing activity (proper contract signed, every involved person duly informed, etc.), then you get in trouble with your ISP:

• Either due to the abnormal activity generated from your line,
• Or because they will begin to accumulate abuse reports coming from your targets.

In either way, chances are that you internet connection will be shut down and that you will have to subscribe to another ISP (again such direct measure will most likely affect personal Internet access than corporate ones where the ISP will show more care before loosing a customer).