Network Penetration Testing

Network penetration test aims to identify and exploit vulnerabilities in network devices, hosts and other systems. The test simulate the activities of a malicious hacker. In other words the purpose of the test is to reveal vulnerabilities allowing an unauthorized user to steal sensitive data or to take-over corporate systems for malicious purposes.
During the test SoCyber is testing the security of routers, switches, firewalls, IPS/IDS devices, VPNs, servers, anti-virus systems and more.
In addition the network penetration tests which SoCyber provides will reveal the vulnerabilities through both hackers’s and network security professional’s perspective.

When important web and mobile applications are present, web application penetration test and mobile application penetration test could also be useful for the company.

Methodology

  • Layer 2 Attacks
  • VLAN Hopping
  • ARP Cache Poisoning
  • Switch Architecture Weaknesses
  • Layer 3 Attacks
  • IP Redirections
  • Session Hijacking
  • Session Replay
  • Network / OS Layer Attacks
  • Network Hash Passing
  • DHCP and DNS Weaknesses
  • Various OS Weaknesses
  • Advanced Attacks
  • Protocol Fuzzing
  • Cryptographic Weaknesses
  • Buffer Overflow
  • Zero-day

Categories

External network penetration test

During the test experts are trying to discover security issues from the outside of your network, generally over the public Internet.

Internal network penetration test

Test is performed by placing an expert within your corporate environment and providing him with connection to your internal network in order to look for security issues from the inside. Therefore, the internal penetration test will examine resources available to anyone inside the security perimeter.

In terms of knowledge about the application the test can be separated on:

White box vs Black box testing

Black Box Testing

It requires no knowledge of internal paths, structures, or implementation of the tested software.

Gray Box Testing

In Gray Box testing a tester attempts to find defects and bugs with incomplete information of the software product’s inner code structure or programming rationale.

White Box Testing

White Box testing provides the tester with knowledge of the application structure and functionality. The purpose of the white box testing is to test the application from developer’s point of view.

Reporting

Penetration testing report covers the activities, performed during the penetration testing. Therefore the report represents the discovered vulnerabilities in two parts:

Management part

 
  • A general description of the security of the systems.
  • The impact that the discovered vulnerabilities might have on the information security.
  • Required security measures to address the problems.

Technical part

 
  • Definition and classification of risk levels, used to classify the detected vulnerabilities.
  • Description of the information gathering phase for identifying information systems.
  • Results of scanning and exploitation of detected vulnerabilities, description, impact, criticality, affected asset, proof of concept, vulnerability replication method, and remediation steps.

Details

  • Your developers might be good in the development of functional, fast and scalable applications, but security is another topic. Pentest is recommended for those without Internal pentesting team.
  • Penetration tests are often required by mandates like PCIDSS, HIPAA/HITECH and FINRA.
  • Web application penetration testing is especially valuable if your business is dependent on your application, it holds your clients private data or it as options for onlie payments and orders.
  • Penetration testing can help you comply with the technical requirements of GDPR.

Up to 15 days for 10IP addresses, depending on the complexity.

There isn’t official certificate in the sector, however after testing>fixing>re-testing you will receive a clean report, demostrating that your application is free of vulnerabilities.

We can engage our partners to fix your vulnerabilities if you lack expertise. We avoid fixing them on our own due to conflict of interests.

Our process

Scoping

  • Define time frame
  • Set the scope

Reconnaissance

  • Passive data gathering
  • Active data gathering

Scanning

  • Automated scan
  • Results review
  • False positives validation
  • Manual findings verification

Exloitation

  • Manual testing
  • Exploitation of vulnerabilities

Reporting

  • Summarization of the information
  • Management reporting
  • Technical report
EXPLORE ALL OUR SERVICES