Ethical hack or penetration test is performed on enterprise applications by a third party to find vulnerabilities in the application so that they can be remidiated before a new application goes live in production

Ethical hacking is essentially the act of unearthing vulnerabilities in a web based application before going live so that they can be fixed before being accessed by anyone. People who do it are IT professionals, not by hackers with darker intentions. Many companies use different third party providers for ethical hacking services. For example, one large bank or large internet vendor might utilize outside professional services yearly to test their major applications yearly, using a different firm each time. The idea is to get a different perspective, because methodologies differ from firm to firm, not to mention the different habits of the people performing the test.

While published text, articles and books abound on how to conduct EH test, there is hardly any material available to help large corporations show a way to monitor and implement remediation for the EH findings across thousands of web applications runnings on possibly tens of servers. This article attempts to throw some light on that process.