An Integrated Framework to Enhance Penetration Testing for ICT Market Applications

The increasing complexity of Information and Communication Technology (ICT) systems has created significant challenges for cybersecurity professionals in ensuring comprehensive security assessments. Traditional penetration testing methodologies (e.g., PTES, OWASP WSTG, NIST SP 800-115) often lack systematic integration of modern threat intelligence and fail to address the unique requirements of diverse ICT market applications. This research proposes the IPTF framework, an integrated seven-phase penetration testing methodology designed to enhance security assessment effectiveness across e-commerce web applications and mobile banking platforms. The framework integrates pre-engagement reconnaissance, threat modeling, scanning and enumeration, vulnerability assessment, exploitation, post-exploitation, and comprehensive remediation reporting into a cohesive methodology. Through practical implementation in two distinct case studies, the framework demonstrated significant improvements in vulnerability detection rates, assessment efficiency, and remediation guidance quality. Case Study 1 focused on an e-commerce web application, revealing 47 vulnerabilities including 8 critical issues spanning authentication, payment processing, injection, and access control. Case Study 2 examined an Android mobile banking application, identifying 42 vulnerabilities with 7 critical findings in secure storage and API communications. The framework achieved 94% vulnerability detection accuracy and reduced assessment time by 33% compared to traditional PT methodologies (baseline: PTF by TrustedSec, integrating PTES, OWASP WSTG, and NIST SP 800-115). This research contributes to the field by providing a practical, repeatable, and comprehensive penetration testing methodology that addresses current gaps in ICT security assessment practices. The framework’s modular design allows adaptation to various ICT market segments while maintaining methodological rigor and practical applicability.