Penetration Testing

Network - Pentest

In a penetration test on a network, internal or Internet-accessible addresses or address ranges for signs of security problems. Common questions asked here are:

• How far does an attack come from externally (e.g., Internet)?
• If someone has access to a network socket/LAN/VoIP connection in the building - what is possible?
• How well does our firewall withstand an attack? Are there configuration gaps?
• What would happen if an attacker was able to compromise a web server in our DMZ?

Penetration testing for web applications & web APIs.

Penetration testing for web applications examines the overall security and potential security risks of web applications, including programming errors, improperly functioning authentication or authorization, session management, and injection vulnerabilities such as XSS or SQL injections. Likewise, related and accessible infrastructure components, such as web or database servers, are included in the penetration testing and examined for vulnerabilities.

Cloud Penetration Testing

Cloud providers such as Amazon AWS, Google Cloud Platform (GCP) and Microsoft Azure offer a high number of services, but generally follow a shared responsibility model. The cloud service provider is responsible for the security of the cloud. This includes. the hardware, the back-end infrastructure, and the technical implementation and secure programming of the service.

However, the customer is must take responsibility for security in the cloud through proper configuration of the servers and services, the permissions granted and much more. Often, the threat results from the insufficient configuration of these increasingly complex services that are becoming more complex.

Cloud penetration testing examines the security of a Cloud deployment. Such a pentest provides recommendations for improving the security of the cloud environment.

Social Engineering Penetration Test

Social engineering is an attack tactic that involves using deception to gain access to to information or premises, which is then used for malicious purposes.

The most common example of this is the classic phishing scam. In such a penetration test, pentesters use special phishing tools to test defense mechanisms, detection and response capabilities. Also the penetration into the physical security zones - past the security team - can also pose a major threat, for example when a hack box, pose a major threat and can be tested with a penetration test.

For obvious reasons, these types of penetration tests are bound by strict ethical principles and take place with very transparent rules.

Mobile App Penetration Testing

The proliferation of mobile apps, continues to increase steadily. In the process, business-critical information is often not only transmitted, but also stored directly on the mobile device.

A mobile app penetration test checks whether an attacker can gain access to the company and user data, and whether this data can be accessed. and user data and whether this could result in further risks for the internal company's internal network.

Client Penetration Test

Let's face it - most attacks on corporate networks run via a user machine and take advantage of the triad of Outlook & Exchange & Active Directory.

Security vulnerabilities in system-aware applications such as the Software Distribution and improperly configured system services offer malware such as ransomware excellent gateways into the corporate network.

This penetration test is about finding out, what opportunities exist after a user has user has misclicked once or an attacker has attacker has gained physical access to a client.

Red Team

Red teaming involves testing the entire defense of an environment. In doing so, pentesters often also use means of social engineering for initial access to establish a covert command-and-control (C2) channel.

While a normal penetration test performs an analysis in depth Red Teaming goes into breadth in an attempt to achieve the agreed upon goal. In a Red Teaming, the performance of the own IT environment with regard to incidents is of the own IT environment regarding Incident Detection & Response.

Red Teaming is aimed in particular at companies and institutions that already have a high level of have reached a high level of maturity of their IT security.

Custom penetration testing

Penetration testing of scenarios, systems, and components not listed here include:

• Data exfiltration testing
• Security testing of products
.
• WiFi / WLAN
• VoIP systems
• Active-Directory Security Assessment
• Environments with IoT/SPS devices

Contact us for a personal consultation!