Penetration testing is an integral part of security testing. It is typically performed on a functioning system that is reaching or has been already passed into production. The goal of this testing method is to identify vulnerabilities by mimicking adversary behavior, i.e., attack the system under test. Because expert knowledge required to find and exploit vulnerabilities, penetration testing is typically performed by security experts specializing in this particular testing method.

Penetration testing-related activities can be organized into four phases: planning, discovery, attack, and reporting. In the attack phase, penetration testers exploit vulnerabilities to elevate privileges, access resources, or change the state of the system. In many cases, attacks allow penetration testers to broaden the attack surface of the system under test, learning about and accessing additional components. Offensive security tools play a major part in this phase.
The goal of this MSc thesis is design and implement automated tests for the attack phase of penetration testing. Specifically, the student is to design and implement security tests in an automated and reusable manner, providing a security testing suite ready to be deployed in penetration testing. The test case suite should also be capable of automatically evaluating the performed tests.

Tasks to be performed by the student will include:

- Provide an overview of penetration testing methodologies and activities
- Design reuseable test cases (so called test case templates) for automated penetration testing
- Design for each reusable test case a corresponding observer that can automatically evaluate the success or failure of a given test case
- Implement the designed test case templates and observers
- Evaluate the effectiveness of the implemented test case templates and observers on an IoT testbed