A Systematic Literature Review on Penetration Testing in Networks: Future Research Directions

Abstract

Given the widespread use of the internet at the individual, governmental, and nongovernmental levels, and the opportunities it offers, such as online shopping, security concerns may arise. Cyber criminals are responsible for stopping organizations’ access to internet, for stealing valuable and confidential data, and causing other damage. Therefore, the network must be protected and meet security requirements. Network penetration testing is a type of security assessment used to find risk areas and vulnerabilities that threaten the security of a network. Thus, network penetration testing is designed to provide prevention and detection controls against attacks in the network. A tester looks for security issues in the network operation, design, or implementation of the particular company or organization. Thus, it is important to identify the vulnerabilities and identify the threats that may exploit them in order to find ways to reduce their dangers.The ports at risk are named and discussed in this study. Furthermore, we discuss the most common tools used for network penetration testing. Moreover, we look at potential attacks and typical remediation strategies that can be used to protect the vulnerable ports by reviewing the related publications. In conclusion, it is recommended that researchers in this field focus on automated network penetration testing. In the future, we will use machine learning in WLAN penetration testing, which provides new insight and high efficiency in performance. Moreover, we will train machine learning models to detect a wide range of vulnerabilities in order to find solutions to mitigate the risks in a short amount of time rather that through manual WLAN penetration testing, which consumes a lot of time. This will lead to improving security and reducing loss prevention.

Bridging the Gap: A Survey and Classification of Research-Informed Ethical Hacking Tools

“…Existing reviews of Ethical Hacking tools typically focus on industry practitioner tools, with occasional consideration of research-informed tools. Many popular practitioner tools included in these reviews (e.g., [15,2,163,164]) are recurrent: Nmap, Metasploit Framework, OpenVAS/GVM, Nessus, Burp Suite, OWASP ZAP, SQLMap, BeEF, Nikto, W3AF, and others.…”

“…Moreover, Alhamed et al [163] analyse around 20 mostly practitioner tools, with good coverage of network vulnerability and exploitation in particular. However, they consider existing research proposals for mitigating techniques.…”

Enhancing Mobile Security through Comprehensive Penetration Testing

“…Unlike conventional penetration testing that concentrates on assessing network, server, and web application security, Mobile Pen Testing is finely tuned to scrutinize the vulnerabilities specific to mobile applications and devices. Mobile technology's pervasive presence has made mobile devices prime targets for cyber threats, necessitating specialized security measures [1]. Mobile Pen Testing is precisely tailored for this purpose.…”

Enhancing Web Application Security through Automated Penetration Testing with Multiple Vulnerability Scanners

“…A WAV is defined as "a flaw in the application that stems from coding defects and causes severe damage to the application upon exploitation" [4]. To identify and mitigate vulnerabilities that may be exploited by attackers, a penetration testing method or ethical hacking is used [5]. The Open Web Application Security Project (OWASP) provides the standard for such penetration testing methodology to test web applications and could be used to evaluate the effectiveness of web vulnerability scanners [6,7].…”