Penetration tests of systems under test

A system comprising:

• a processor;
• and
• a non-transitory machine-readable storage medium storing instructions executable on the processor to:
• receive information traffic communicated over a network by or with a system under test (SUT);
• receive profile information of the SUT, the profile information indicating a penetration test mode for the SUT;
• analyze the information traffic to identify a technology used by the SUT;
• and
• determine a collection of penetration tests for testing the SUT based on the identified technology and the penetration test mode indicated by the profile information, and further based on a dynamic knowledge base that includes information relating to vulnerabilities and threats.

A method performed by a system comprising a hardware processor, comprising:

• receiving information traffic communicated over a network by or with a system under test (SUT);
• analyzing the information traffic to identify a technology stack and a communication protocol used by the SUT;
• and
• determining a collection of penetration tests for testing the SUT based on the identified technology stack and the identified communication protocol, and further based on a dynamic knowledge base that includes information relating to vulnerabilities and threats, wherein the determining of the collection of penetration tests for testing the SUT is based on information of a first vulnerability or threat retrieved from the dynamic knowledge base, the first vulnerability or threat correlated by the dynamic knowledge base to the identified technology stack, and
• wherein the determining of the collection of penetration tests for testing the SUT does not test for a second vulnerability or threat responsive to the knowledge base specifying that the identified technology stack as identified by the analyzing of the information traffic has the protection against the second vulnerability or threat.