Core's Comprehensive Penetration Testing services mimic an attacker seeking to access sensitive assets by exploiting security weaknesses existing across multiple systems. This service not only identifies individual vulnerabilities but also reveals how networks designed to support normal business operations can provide attackers with pathways to backend systems and data.
During the engagement, we begin by assessing your network or application infrastructure’s “weakest links,” as well as other possible venues of attack. We then determine the ramifications of each compromise by attempting to escalate privileges on the entry points and pivoting the assessment to determine whether any other systems can be subsequently targeted and breached.
Types of Penetration Tests:
Some of the tests that we engage in are:
Web Application Security Testing
In this type of penetration test, we assess the security of the application by focusing on remotely exploitable vulnerabilities, application architecture, design and implementation. We also assess the controls with respect to user access, privilege levels, development and delivery, and overall design of the applications. This helps to give the total threat profile of your web application environment.
Network Penetration Testing
This type of a penetration test involves identifying the targets through Google searches, WHOIS, DNS queries, etc. Fingerprinting and identifying vulnerabilities. The exploitation of these vulnerabilities depends on whether it is part of the engagement or not. Limited exploitation is always done in terms of password guessing, directory traversals, file uploads, etc. Before going for stronger exploitation methods such as Denial of Service attacks, Buffer Overflow exploits, etc., we take prior written consent from the management so as to not to cause possible fallouts from the such exploitation methods.
Automated port identification
In large and very large networks, what is required is an automated way to periodically scan a large range of IP addresses, determine what ports are open, and attempt to identify the service running on those ports. An important activity is to produce trending analyses reports, which show new IP addresses or new ports that have appeared since the last scan was run.
Benefits in engaging with Websmith:
Our penetration testing service is a highly creative, out-of-the-box engagement, and often results in new vulnerabilities being discovered or a new tool being developed from such an exercise. Our teams are highly passionate and committed to doing as comprehensive an assessment as possible