What is Penetration Testing?
It is an authorized simulated attack on a computer system that looks for security weaknesses, potentially gaining access to the system’s features and data.The goal is to build strategies that help secure and protect the environment.
Testing is performed in two stages:
- Vulnerability assessment – against the identified infrastructure to highlight vulnerabilities that an attacker might use.
- Vulnerability testing – to perform various penetration tests for better understanding and improvements upon the organization’s present security situation.
The service is usually conducted in one of two possible scenarios:
- WLAN vulnerability– Externally testing of possible vulnerabilities that come from the Internet and facing the customer network
- LAN vulnerability – Internally testing vulnerability, especially important for clients with distributed network
Our approach
We test your organization’s susceptibility to Cyber Vulnerabilities with safe, pre-approved, and authorized attacks on targeted endpoints. The goal of the service is to help an organization understand and improve upon its present security posture.
Testing follows the phases:
Organizational Intelligence Stage contains:
In this phase we gain an understanding of the organization and its Internet presence as well as any digital asset information.
- Social Media (Facebook, LinkedIn, blogs…)
- Search Engine results (Google hacking, username/email harvesting, employee information)
- Domains registered by the company (mail, web, ftp and other server identification)
- Company website (services/skills used by the company, partnerships, services provided)
Network and Application Assessment Stage
Assessments are made to discover all live hosts and services running within the organization’s network range.
- Port scanning (standard and non-standard ports are probed)
- IP scanning (discovering hosts and verifying host status)
- DNS Lookup
- Service fingerprinting (banner grabs, response analysis, known port lookup)
- Service enumeration (pull relevant information from open services)
- Operating System identification
Vulnerability Detection and Analysis Stage
The Vulnerability detection Stage e is an interactive process with the customer network to discover any vulnerabilities that exist on the hosts discovered in the previous phases.
- Service Scanning
- Vulnerability Scanning (typically conducted with third party tools)
- Manual Checks
Exploitation of Vulnerability Stage
In this phase we attempt to exploit the vulnerabilities detected in the previous phases in order to gain unauthorized access to the host.
- Vulnerability exploitation (typically remote but not limited to):
- Use of known exploitation tools
- Use of custom created scripts or modified third-party scripts
- Account hash dumping (password cracking attempts can be made, hashes can be passed)
- Escalation from low level accounts (horizontal or vertical)
- Shell code injection (in vulnerable applications)
Reporting
- An executive summary
- A detailed technical report with recommended action plan
- An onsite final presentation