A Review of Penetration Testing Frameworks, Tools, and Application Areas

Both government and private organizations are rapidly fortifying their cybersecurity measures to cope with recent trends in cyberattacks. In general, these attacks target several critical infrastructures including computer networks, web applications, and IoT devices. One of the strategies to reduce the risk of cyberattacks is penetration testing. Penetration testers use the same as the malicious attacker tools, and frameworks to try to penetrate systems to find vulnerabilities before launching adverse cyberattacks. The present study examines cybersecurity penetration testing frameworks that have been widely implemented as well as frameworks from the development of existing frameworks. And examines reviews use of tools in each stage of testing and focusing on specifics platform area is guided by the research question, so it refers to selection of papers for review. This research reviewed 30 relevant papers between 2018 and 2022 from conference proceedings and leading journals. Our analysis indicates that the top penetration testing frameworks and tools frequently used by organizations or individuals tend to focus on web-based applications. Each framework provides certain techniques and a certain sequence of stages in penetration testing, although they differ slightly, the methodology is general. In addition to the web platform, there are other platforms including computer networking, IoT, and mobile applications. We note that most penetration testing frameworks still suffer from inherent challenges, which carve the path for future research directions.