A penetration test is a security assessment for your organization's internal or external IT infrastructure and exposed network services. Before the penetration test begins, goals and specifications for the test are defined together with your team.
An external penetration test's most common goal is to determine whether an attacker can gain a foothold in your company's internal network.
In an internal penetration test, the two most common scenarios are that either an attacker succeeds in compromising a host computer (e.g., through a phishing attack) or an attacker succeeds in gaining physical access to the network ("cleaning staff scenario").
External Penetration Test
The external penetration test is carried out from the perspective of an outside attacker who analyzes the publicly available IT infrastructure of your organization. We are following the same steps an attacker would take to gain access to your organization's internal networks. The following is an exemplary list of actions taken:
Enumeration
Identify Vulnerabilities
Exploit Vulnerabilities
Post Exploitation
Continuation/restart of the process
As soon as internal access is available, the entire process may start again from the perspective of an internal attacker who has already received internal network access (e.g., to the DMZ).
The external penetration test is a service offering that should be used after your company has tried to harden the external perimeter - mainly through patching and secure configuration of available services. This validates the effort that your company has invested in prevention and protection and, if necessary, identifies possible areas with potential for improvement.
Internal Penetration Test
The internal network penetration test can be carried out in different ways. Some of the more common scenarios are as follows:
Compromised host scenario
Your company provides user accounts to be used for the assessment. Providing the accounts would simulate an attacker successfully launching a spear-phishing attack and gaining internal access and/or a malicious internal agent. Access to the user's system via:
- Remote access (e.g., VDI)
- Image to boot
- End-user laptop
Compromised server in the DMZ scenario
Your company provides user accounts to be used for the assessment. Providing the accounts would simulate an attacker successfully launching a spear-phishing attack and gaining internal access and/or a malicious internal agent.
Cleaning staff scenario
Use of a network connection within your company. The implementation is usually either carried out remotely by connecting a mini-computer to one of your network sockets or on-site with one of your experts.
Regardless of the scenario, the test begins again with the same steps an attacker would take.
Reconnaissance
Enumeration
Exploitation of vulnerabilities
Post exploitation
Continuation/restart of the process
The internal penetration test is very valuable for companies that want to know what an attacker can do and what they can gain access to if an internal system has been successfully compromised.
An internal penetration test should be carried out after your organization has invested time and money in the internal network to ensure that the configuration and processes used are successful in providing comprehensive protection for the infrastructure.
Special Scenario
Command and Control (C2) & Exfiltration
During a C2 assessment, we examine the technical and organizational abilities of your organization to detect and block sophisticated malware as well as to react to malware that is sent via email.
In particular, it is also about checking which options are available in your company infrastructure to recognize and also to block the communication channels used by attackers for C2 and data exfiltration.
Special Scenario
Pivoting & Lateral Movement
Starting from a basic user account, we try to gain access to other systems, identify sensitive information, escalate permissions on the system, and to other areas of the network. The access level used as a starting point simulates what an attacker might have gained through a successful phishing email campaign or by impersonating an employee or contractor.