Penetration testing is a unique approach to solving network security problems. Research on computer network security shows that the organizations who spend the most on security are the ones who have already sustained breaches at a critical level. This reactionary approach taken by most businesses, especially SMBs, can prove to be a costly and timely mistake. Disgruntled employees, irritated customers and competing organizations can all do irreparable damage to your business critical systems.

Organizations that are interested in a proactive approach to security should consider offensive measures for simulating attacker methodologies and techniques. The number of vulnerabilities and testing techniques increase every day, presenting many entry points into the infrastructure. Our group members stay on the leading edge of delivering world class penetration testing services with ongoing research, development, and training. Our hands-on experience and top quality deliverable exceed client expectations.

Penetration testing services include both manual and automated approaches to meet your project goals and requirements. Defining the goal for penetration testing can be a challenge for some organizations as many projects are initiated as a result of third party regulatory compliance requirements. When speaking with our team, you will be assured that the scope of your project will be well defined.

We offers both internal and external testing against all types of targets and all sizes in scope.

Contact us today to speak with a security consultant about your project.


Did you know?

  • Penetration Testing is an important part of any security program
  • Penetration Testing is not Vulnerability Assessment
  • Penetration Testing should follow industry standard testing methodologies
  • Penetration Testing should be performed at least once a year and after any significant application modification or network upgrade
  • Internal Penetration Testing tests an organization’s internal monitoring and Incident Response (IR) capabilities
  • External Penetration Testing tests an organization’s external monitoring and Incident Response (IR) capabilities




STEPS INVOLVED IN PENETRATION TESTING




Reconnaissance


The first and foremost step for a penetration test is reconnaissance. The main objective is to gather information about the target system which can be used in a malicious manner to gain access to the target systems.

Successful reconnaissance can often be successfully achieved through passive steps such as social engineering. Here, the hacker will attempt to ‘probe’ relevant personnel into revealing sensitive information. Unlisted phone numbers, passwords and even sensitive network information are often divulged by unsuspecting employees and managers. Other techniques used include ‘dumpster diving’ where an organization’s trash is searched for redundant sensitive information such as passwords.

Active reconnaissance refers to the probing of a network in order to detect possible routes to access. These may include:

  • Accessible hosts
  • Open ports
  • Location of routers
  • OS details
  • Details of services

At the end of this stage an intelligent attack strategy is compiled based upon relevant findings.

Scanning and Enumeration


Scanning refers to the stage where the hacker scans the network with specific information gathered from the reconnaissance phase.

Scanning and Enumeration are intelligent ways of gathering sensitive information about the target company’s network architecture. Information relating to the company’s IP addresses, OS, DNS servers and Zone Transfer information can sometimes be extracted using specialist techniques that fall into this category. Scanning can essentially be considered the rational extension of reconnaissance.

Scanning involves steps such as intelligent system port scanning which is used to determine open ports and vulnerable services. In this stage the attacker can use different automated tools to discover system vulnerabilities.

Other techniques used in this phase include:

  • Network Mapping
  • Sweeping
  • Use of Dialers
  • Vulnerability Scanners

The risk to a network if this stage of real life security attack was successful is considered to be very high. At the end of this stage the hacker would have established the points of entry with which to launch an attack.

Gaining and Maintaining Access


This phase is where the ethical hacker will attempt to actually gain access to the target systems or network. The exploit could occur over a LAN, the internet, offline or as deception or theft.

After the scanning phase where the ethical hacker has established all necessary information about target network, he will try to exploit possible system vulnerability to get into the actual network. Additional vulnerabilities could also be created using backdoor Trojans or dialers. The penetration tester might need to use ‘sniffer’ techniques in order to capture data packets from the target network.

This is the most important stage of penetration testing in terms of establishing the potential damage to the target systems. During a real security breach it would be this stage where the hacker can utilize simple techniques to cause irreparable damage to the target system.

What a hacker could and could not do would primarily depend on four influencing factors:

  • Architecture
  • Configuration of the target system
  • Individual skill of the hacker
  • Initial level of access obtained

Gaining and Maintaining Access


This phase is where the ethical hacker will attempt to actually gain access to the target systems or network. The exploit could occur over a LAN, the internet, offline or as deception or theft.

After the scanning phase where the ethical hacker has established all necessary information about target network, he will try to exploit possible system vulnerability to get into the actual network. Additional vulnerabilities could also be created using backdoor Trojans or dialers. The penetration tester might need to use ‘sniffer’ techniques in order to capture data packets from the target network.

This is the most important stage of penetration testing in terms of establishing the potential damage to the target systems. During a real security breach it would be this stage where the hacker can utilize simple techniques to cause irreparable damage to the target system.

What a hacker could and could not do would primarily depend on four influencing factors:

  • Architecture
  • Configuration of the target system
  • Individual skill of the hacker
  • Initial level of access obtained

Covering Tracks


The final stage of penetration test or ethical hacking is to check whether the ethical hacker can erase or cover the mark that has been created in earlier stages of the test.

At present, many successful security breaches are made but never detected. This includes cases where firewalls and vigilant log checking were in place. From this stage we can establish what attacks and exploits a hacker is able to cover up and which we can easily detect.

In order that the target company’s security engineer or network administrator cannot detect the evidence of attack, the hacker needs to delete logs files and replace system binaries with Trojans. The attacker can use automated scripts and automated tools for hiding attack evidence and also to create backdoors for further attack.


Previous tab Next tab