Penetration testing

I test your network, devices and systems the way an attacker would, but within an agreed scope and time. At the end you get a report with risk ratings and a list of the fixes worth starting with.

When a test makes sense

Before a system goes live

Before a new system or application reaches its users and the internet.

After network changes

After replacing the firewall, introducing new segmentation or connecting another site.

Before an audit or inspection

Test results show that the safeguards actually work, not just that they are described in policies.

Regularly

New vulnerabilities appear every week, and configuration drifts over time.

Scope of testing

I test from the internal network and from the internet.

Basic scope about 1 day

  • Reconnaissance: websites, RIPE database, DNS servers, e-mail headers, search engines and job portals
  • Scanning IP addresses (ICMP, TCP) and TCP/UDP ports using different methods (SYN, connect, FIN, Null, Xmas)
  • Identifying systems, applications and devices, and their software and firmware versions
  • Attempts to redirect traffic by ARP table poisoning and using ICMP
  • Man-in-the-middle attempts: session hijacking, traffic sniffing, password capture
  • Attempts to take control of infrastructure devices
  • Analysis of local network traffic at every layer of the ISO/OSI model

Extended scope about 2 days

Everything in the basic scope, plus:

  • Review of system, device, application and database configuration against good practice
  • Search for known vulnerabilities and exploits (CVEs) in the detected software versions
  • Scanning with two independent tools across all operating system families
  • Report of missing critical and recommended patches and updates
  • Risk ratings for the gaps found
  • Recommendations that raise the level of security, ordered by priority

What I look at closely

Devices

  • switches, firewalls and access points
  • cameras and access control systems
  • UPS units and server room environmental monitoring
  • storage arrays and backup appliances
  • admin panels and server remote management controllers

Protocols in traffic analysis

Ethernet, IP, TCP and UDP, DNS, DHCP, RDP, SMTP, POP3, IMAP, FTP and HTTP.

I look for passwords sent in clear text, services exposed for no reason and traffic that should not flow between zones.

How it runs

  1. Agreeing the scope and rulesaddresses and systems to test, the time window, a contact person in the organisation and written consent for the tests
  2. Testingabout 1 day for the basic scope and 2 days for the extended scope
  3. Reportabout two weeks after testing ends
  4. Results reviewgoing through the gaps found and agreeing the order of fixes
  5. Retestchecking that the fixes work

The report and safe testing

What the report contains

  • vulnerabilities found, with risk ratings
  • missing patches and updates
  • advice on which fixes to start with
  • a summary for management

Rules

I test only with written consent, within the agreed scope and hours, and with a contact person in the organisation. I do not modify data.

If I find something critical during testing, I don't wait for the report. I let you know straight away.

Want to see your network from an attacker's side?

Tell me what needs testing and I will suggest a scope and a date.

Ask about testing