What is a Pentester?
Penetration testing (pentesting), or ethical hacking, is where you assess the security of networks, websites, endpoints, mobile devices, wireless devices, operational technology/industrial control system (OT/ICS) infrastructure, and the security of physical facilities. This assessment might include performing vulnerability scanning and analysis, reviewing source code, performing open source intelligence (OSINT), gaining access to a target by exploiting vulnerabilities, escalating privileges, maintaining persistence, and more.
A key thing here is that you have permission as a pentester to attack the target, as defined in the statement of work (SOW) of the penetration test (pentest). If you don’t have permission, then it’s illegal. Before starting any pentest, you need to review the rules of engagement (ROEs), determine the scope of the pentest, and verify that the client owns everything that’s listed. I’ve reviewed SOWs before...
