Discovery & Reconnaissance

The reconnaissance phase, often referred to as "recon," is the initial step in a penetration test. This crucial stage involves gathering as much information as possible about the target system or network. The objective is to identify potential vulnerabilities that can be exploited in later stages of the penetration test.

During the recon phase, our ethical hackers employ various techniques to collect data. These include passive methods such as open-source intelligence (OSINT), where publicly available information is gathered without direct interaction with the target. This might involve searching for domain names, IP addresses, and publicly accessible documents that could reveal insights into the target's infrastructure. Active reconnaissance, on the other hand, involves direct interaction with the target system, such as scanning networks to identify live hosts, open ports, and services running on those ports.

Network Mapping & Enumeration

The network mapping phase of a penetration test is essential for understanding the target's infrastructure. During this stage, our ethical hackers identify the topology of the target network, including devices, hosts, and their interconnections. Tools like Nmap are often used to scan for live hosts, open ports, and running services.

This phase provides a detailed map of the network, highlighting potential security weaknesses and points of entry. Accurate network mapping enables penetration testers to strategize their attack methods, ensuring a comprehensive assessment of the network's security posture and helping to pinpoint areas that require fortification.

Service Enumeration

The service enumeration phase of a penetration test focuses on identifying and cataloging the services running on the target network’s open ports. Ethical hackers probe deeper into the network to gather detailed information about software versions, configurations, and active services.

Again, tools like Nmap and Netcat are utilized to perform this task efficiently. By discovering specifics about each service, such as version numbers and potential vulnerabilities, penetration testers can pinpoint weak spots that could be exploited. This phase is critical for developing targeted attack strategies and ensuring a thorough evaluation of the network’s security defenses.

Vulnerability Assessment

The vulnerability assessment phase of a penetration test involves identifying and evaluating security weaknesses within the target system. During this stage, our ethical hackers use automated tools and manual techniques to scan for known vulnerabilities in software, configurations, and network components. Tools like Nessus, OpenVAS, and Nuclei are typically used to detect issues such as outdated software, misconfigurations, and unpatched vulnerabilities. This phase is crucial for understanding the risk landscape of the target environment. The discovered issues from the vulnerability assessment guide our penetration testers in prioritising their efforts, ensuring that the most critical vulnerabilities are addressed to enhance the overall security posture.

Password Testing

The password testing phase of our penetration tests evaluates the strength and security of passwords used within the target system. Ethical hackers employ various techniques, such as brute force attacks, dictionary attacks, and password spraying, to test the resilience of user credentials.

Tools like Hydra, John the Ripper, and Hashcat are typically used to automate these attacks. This phase helps identify weak or default passwords, poor password policies, and other vulnerabilities related to authentication mechanisms. By exposing these weaknesses, penetration testers can recommend improvements to password policies, enhancing the overall security and protecting against unauthorised access.

Vulnerability Research

The vulnerability research phase of a penetration test involves an in-depth analysis of identified vulnerabilities to understand their potential impact and exploitability. Ethical hackers examine the details of each vulnerability, often referencing databases like CVE (Common Vulnerabilities and Exposures) and security advisories to gather relevant information.

We use tools and techniques to replicate potential exploits in a controlled environment, assessing how vulnerabilities can be leveraged to gain unauthorized access or cause damage. This phase is crucial for providing detailed risk assessments and actionable remediation steps, ensuring that vulnerabilities are effectively mitigated to enhance the security posture of the target system.

Exploitation

The exploitation phase of our penetration testing service involves actively attempting to exploit identified vulnerabilities to gain unauthorised access or control over the target system. Our ethical hackers use specialised tools or potentially custom exploits to launch controlled attacks, demonstrating the potential impact of each vulnerability.

This phase aims to validate the presence and severity of vulnerabilities by achieving specific objectives, such as gaining administrative privileges, accessing sensitive data, or pivoting through the network. The exploitation phase provides concrete evidence of security weaknesses, highlighting the need for remediation and helping organisations understand the real-world risks posed by the identified vulnerabilities.

Exfiltration

The ex-filtration phase of a penetration test focuses on testing the ability to extract sensitive data from the target system without detection. Our ethical hackers, having gained access through previous exploitation, simulate data theft to evaluate the effectiveness of the current security controls.

We attempt to move data out of the network using various techniques, implementing the methods used by malicious actors. This phase helps assess the organisation's data protection measures, incident response capabilities, and overall security posture. Identifying weaknesses in data ex-filtration defenses allows organisations to strengthen their security strategies and better protect against potential data breaches.

Lateral Movement

The lateral movement phase of a penetration test involves navigating through the network after initial access has been gained. Our pentesting service attempts to move from the compromised system to other systems within the network, aiming to escalate privileges and access sensitive data or critical systems.

Techniques include exploiting trust relationships, leveraging stolen credentials, and using tools like Mimikatz to extract passwords. This phase tests the effectiveness of internal security controls and segmentation. By simulating lateral movement, our pentesting service helps organisations identify and address weaknesses in their internal defenses, enhancing overall network security and potentially preventing widespread breaches.

Reporting

All discovered security findings are documented in severity ordered report with clear concise remediation instructions and their associated risk and impact.

Retesting

All our manual assessment services come with a single free retest on reported findings.