PENETRATION TESTING & VULNERABILITY ASSESSMENTS
Reliable Partner on Your Path to NIS2 & DORA Compliance
contact US
Services
CONVENTIONAL PENETRATION TESTING
Application Security
WEB
Web application penetration testing is an essential security practice. It helps organizations identify and mitigate vulnerabilities in their web applications, protecting them from damaging cyberattacks.
While assessing the security of web applications we aim to identify and compromise as much vulnerabilities as possible within a given limited time-frame. Using a black-box approach (a.k.a Dynamic Application Security Testing, DAST) we have no initial knowledge about the target. This method simulates a real-world attack. For better accuracy and time efficiency a grey-box approach can be used which allows us to have partial insights about the target.
Adhering to the OWASP ASVS (Application Security Verification Standard) we employ our hands-on expertise to analyze the application’s logic. This human-powered manual approach allows us to evaluate security as precise as possible.
Mobile
Mobile application security is often overlooked, however potential breaches may lead to significant financial and reputational losses. We conduct thorough iOS and Android mobile application penetration tests trying to pinpoint various vulnerabilities. Our findings, if addressed correctly, allow clients to achieve better cyber security and resilience.
We use the OWASP MASVS (Mobile Application Security Verification Standard) as the industry standard for mobile app analysis. The OWASP MASTG (Mobile Application Security Testing Guide) is a valuable companion when verifying controls defined within MASVS.
API
APIs play a crucial role within the mobile application ecosystem. They are also widely used by many modern web applications, as well as for data exchange between various services. For this reason, APIs are often a primary target for attackers.
When pentesting mobile and/or WEB applications we aim to check every visible and potentially hidden API endpoint. We conduct a detailed analysis of each component to understand the business logic and maximize the identification of vulnerabilities.
Recommendations provided within our pentest report help our clients to implement robust security measures strengthening API security.
Source Code Review
Partial or a full source code audit (often referred to as a white-box approach) is an efficient way to evaluate code quality. It allows to quickly identify security issues that are otherwise not so obvious and cannot be easily found without additional knowledge.
By having access to the source code, we perform a static code analysis (a.k.a Static Application Security Testing, SAST) using both automatic tools and manual reviews. This allows us to spot vulnerabilities which can then be exploited on a running application itself. A successful exploit results in a well-documented proof-of-concept. This way we portray not only a flaw spotted in the source code but also a valid attack with an explained risk level. Within cyber security community this approach is also known as Interactive Application Security Testing or IAST.
Network Security
External Perimeter
Internet facing systems form an external network which is typically directly accessible to anyone, including hackers. Regular penetration testing and vulnerability scanning of such systems allow organizations to maintain high level of security.
To perform the penetration test we only need to obtain a list of client domain names and/or IP addresses. By operating from an offensive standpoint, we evaluate security of every discovered external service/component from as many angles as possible. All identified issues are individually documented omitting any false positives and are later presented within the final report.
Sometimes external critical flaws lead to a complete compromise of a system and allow us penetrate to an internal network (most often to DMZ zone). We may continue internal testing upon agreement.
Internal Perimeter
The most common type of systems that form an internal network are: servers (Active Directory, file, database, etc.), workstations, network appliances, IoT devices and other. Security of these devices is frequently neglected due to a lack of resources (both human and financial) and a lack of knowledge. It is also often assumed that internal systems are safe because they are internal. For these reasons internal networks are often gold-mines for hackers. In case of an internal breach, they are typically compromised within hours.
We believe internal security is no less important than external. Regular internal penetration testing and vulnerability scanning is necessary to increase organization’s cyber immunity.
To perform such assessment, we usually need two things. First, we need obtain necessary information about the client internal systems (i.e. scope subnets). Second, we get agreed access to the target network (either physical or remote). After that we start an active penetration testing phase. During this phase we prioritize each internal segment and analyze it in a time-based fashion. The final report contains all the identified issues together with detailed risk analysis, vulnerability exploitation and remediation strategies.
Wireless Networks
Wireless or Wi-Fi networks form a specific type of internal infrastructure. These networks most often provide employee internal access or guest access to the internet. By nature, they are also accessible to remote attackers within the physical vicinity and therefore pose a serious threat in case poor security measures are implemented.
To verify Wi-Fi security strengths and weaknesses we perform targeted penetration tests against client wireless networks by launching various attacks and implementing different scenarios. These simulated real-world offensive actions allow us to uncover vulnerabilities that may result in an unauthorized access to other networks or data.
Cloud Security
Cloud security is a vital aspect to any cloud-based platform provider or user. Security assessments however vary greatly depending on the target Cloud service model. The most common models are: IaaS (Infrastructure as a Service), PaaS (Platform as a Service) and SaaS (Software as a Service). Clouds can also be native (both local and remote) and commercial (such as AWS, Azure, GCP). Each cloud may use different Hypervisor (such as VMware, Hyper-V, XEN/Citrix, KVM), Containerization (such as Docker, Kubernetes) and cloud management solutions. All of this adds extra complexity to the security assessment process.
Our aim is to gradually scope the cloud infrastructure, gather enough data and knowledge about the platform, understand the client-business risk model. Only then we can establish a testing plan and conduct a proper security check for an individual organization.
IoT Security
Internet-of-Things (IoT) are Internet-aware, smart home devices. They are widely adopted, whether at home or on business premises. Many of these devices are often cheaply made. This means the hardware and the software at the heart of the system (known as the firmware) lacks quality leaving the device vulnerable to a wide range of cyber threats.
Our objective is to slice and approach the targeted IoT environment through different layers, such as: embedded software, network communication, local and remote interface (API, mobile, web). We evaluate each layer from an offensive security standpoint. In the end a well-structured report is created that outlines found issues and presents suggested remediation strategies.
It is also worth mentioning that with the adoption of the EU Cyber Resilience Act (CRA), IoT manufacturers will have to follow specific guidelines in order to achieve compliance.
ADVANCED PENETRATION TESTING
Red Teaming
The purpose of a red team engagement is to evaluate the organization’s overall state of security. This is typically done by not only identifying technical vulnerabilities but by also targeting the human awareness factor, organizational processes (such as incident response, detection capabilities). Strength of organization’s physical security is also often evaluated during a red team exercise.
Our red team engagement is a composition of tactics, techniques and procedures that are used by real-world attackers. During the exercise we tend to follow industry approved frameworks such as MITRE ATT&CK and CAPEC.
Even though red teaming requires prolonged planning and execution, it provides a comprehensive overview of an organization’s defense capabilities and helps to further reduce exposure to cyber threats.
Threat-led Penetration Testing
Threat-led Penetration Testing (TLPT) is a specific form of red teaming. TLPT engagement primarily focuses on emulating a specific threat actor or group. This focus is driven by mainly collecting threat intelligence which can later be used against a targeted organization.
Analogically to red teaming, TLPT requires thorough planning and execution, but as a result provides valuable insights, especially to the organizations seeking protection against specific advanced cyber threats.
Within EU, DORA (Digital Operations Resilience ACT) requirements for specific entities within the financial sector include a mandatory TLPT.
SECURITY AWARENESS
Social Engineering
The old saying goes that human is the weakest link in security. We do think human error plays a frequent and often a key role when a cyber attack happens.
To help our clients raise employee awareness and critical thinking we perform various social engineering campaigns, such as phishing (email spoofing), vishing (malicious phone calls), smishing (malicious SMS), tailgaiting (testing physical security) and etc.
Training
Information security training can be applied to most organizations in many different flavors. Starting from a basic cyber hygiene course for non-technical employees to implementation of Secure SDLC (Software Development Lifecycle) within Agile to product developers and managers.
Reach out in case Your organization needs security related training and we will provide a solution best fitted to Your needs.
Consulting
Whether Your organization has suffered a cyber security incident or You are developing a product and need advice on effective security architecture, our team is ready to assist. We help businesses with various security related technical topics.
Why Choose Us
Long-standing Experience
More than 12 years of extensive infosec & pentesting experience working internationally with various industries and businesses.
Proficient Skills
Sharpened skills due to countless projects delivered. Firm believers in experience rather than certificate, but just in case someone asks we say: CEH, LPT, OSCP, etc.
Hands-on Delivery
A detailed manual testing approach based on human intelligence and experience. Beyond what automated tools and scanners can.
Sectors Secured
Project diversity and experience working with different sectors such as financial, IT, insurance, healthcare, telecommunications, automotive, public, industrial and other.
Compliance Ready
Helping customers to fulfill security requirements defined within regulations such as NIS2, DORA, GDPR, ISO 27001, PCI DSS, SOC2, HIPAA and achieve compliance.
Clear Reporting
An individually customized, clear and concise report providing a comprehensive security overview. Dedicated to both technical and non-technical staff.