Pentesting standards

There were a lot of efforts to create a penetration testing standard that can be comprehensive and at the same time applicable to all situations, but until now we did not know any really successful outcome that could claim to become an industry standard.

The reason here is simple, but nevertheless complicated: each penetration test is a new research that cannot be covered with a constant set of predefined actions. This set can be either too shallow to provide any real value or too determined like an audit, disabling the freedom of a research and maybe providing some value but definitely not giving a view from an attacker's perspective.

Although we do not recommend sticking to any of the existing "penetration testing standards", it will be helpful if you get familiar with the documents (methodologies) listed here to get an understanding of the popular approaches:

• PTES: PTES is an acronym for Penetration Testing Execution Standard (http://www.pentest-standard.org). It is...