A Practical Guide to Penetration Testing & System Hardening

Understanding Penetration Testing & Defense in Depth

Penetration testing is the systematic process of assessing your digital infrastructure by safely attempting to discover and exploit vulnerabilities before malicious actors do. Combined with continuous system hardening, it forms the foundation of proactive cybersecurity.

Phase 1: Reconnaissance & Exposure Analysis

Before testing internal application logic, security auditors map out all publicly exposed infrastructure:

DNS & Subdomain Enumeration: Uncovering active subdomains, staging environments, and legacy APIs.
Port & Service Scanning: Identifying open network ports, running services, and exposed administrative interfaces.
SSL/TLS Audit: Verifying cipher suites, certificate validity, and enforcement of HSTS (HTTP Strict Transport Security).

Phase 2: Web & API Vulnerability Assessment

Web applications and API endpoints are primary targets for external attacks. Testing focuses on key risk areas identified in the OWASP Top 10:

1. Broken Object Level Authorization (BOLA)

BOLA occurs when an API endpoint returns sensitive user objects simply by altering an ID in the request parameters (e.g., changing /api/orders/101 to /api/orders/102). Every request must verify user ownership against session credentials.

2. SQL Injection & Command Injection

Injection flaws occur when untrusted user input is concatenated directly into database queries or system commands. Parameterized queries and ORM abstraction prevent injection vulnerabilities entirely.

3. Cross-Site Scripting (XSS) & Content Security Policy (CSP)

XSS permits attackers to execute arbitrary JavaScript in a victim's browser. Mitigate XSS by sanitizing all HTML output and defining a strict Content Security Policy header:

Content-Security-Policy: default-src 'self'; script-src 'self' https://trusted-scripts.com; object-src 'none';

Phase 3: Infrastructure Hardening Baseline

Once vulnerabilities are identified, system hardening secures the host operating system, network layers, and runtime environment:

SSH Hardening: Disable password authentication in favor of SSH keys. Change default SSH ports and restrict access using IP-whitelisted VPNs.
Firewall Rules: Enforce default-deny firewall policies using ufw or cloud security groups, allowing only HTTP/HTTPS (ports 80/443) and essential management ports.
Container Security: Run Docker containers as non-root users, use minimal base images (such as Alpine or Distroless), and scan container images for vulnerable OS packages.