Penetration Testing

B & A Network Penetration Testing

Baretzky & Associates Technical Security Assessment Services test key aspects of a customer’s environment for flaws that could be taken advantage of. The objective is to build strategies that help secure and protect the environment.

Baretzky & Associates first performs a Vulnerability Assessment against the identified infrastructure to highlight vulnerabilities that an attacker might use to compromise the integrity of the systems in play. Herjavec Group then performs various Penetration Tests in order to better understand and improve upon the organization’s present security posture.

Network Penetration Testing is one of Baretzky & Associates most requested Security Consulting Service offerings. This service is usually conducted in one of two possible scenarios:

  1. Externally from the Internet facing the customer network
  2. Internally in the customer network

Both scenarios are leveraged to test the security measures implemented and processes followed by the customer. Whether internal or external, Network Penetration Testing is executed in the following phases, with the goal of exploiting discovered vulnerabilities:

Intelligence Gathering

In this phase we gain an understanding of the organization and its Internet footprint as well as any digital asset information.

  • Search Engine results (Google hacking, username/email harvesting, employee information)
  • Social Media (Twitter, Facebook, blogs)
  • Domains owned and registered by the company (mail, web, ftp and other server identification)
  • Company website (services/skills used by the company, partnerships, services provided

Network and Application Reconnaissance

Reconnaissance is conducted next to discover all live hosts and services running within the organization’s network range.

  • Port scanning (standard and non-standard ports are probed)
  • IP scanning (discovering hosts and verifying host status)
  • DNS Lookup
  • Service fingerprinting (banner grabs, response analysis, known port lookup)
  • Service enumeration (pull relevant information from open services)
  • Operating System identification

Vulnerability Discovery and Analysis

The Vulnerability Discovery phase is an interactive procedure with the customer network to discover any vulnerabilities that exist on the hosts found in the previous phases.

  • Service Scanning
  • Vulnerability Scanning (typically conducted with third party tools)
  • Manual Checks

Based on discovered hosts and services information as well as manually researched vulnerabilities

Vulnerability Exploit and Privilege Escalation

In this phase we attempt to exploit the vulnerabilities discovered in the previous phases in order to gain unauthorized access to the host.

  • Vulnerability exploitation (typically remote but not limited to): Use of known exploitation tools & Use of custom created scripts or modified third-party scripts
  • Account hash dumping (password cracking attempts can be made, hashes can be passed)
  • Escalation from low level accounts (horizontal or vertical)
  • Shell code injection (in vulnerable applications)

To facilitate the successful transfer of knowledge following a Network Penetration Testing engagement, Baretzky & Associates will document and present our findings. The output to your team will include:

  • An executive summary
  • A detailed technical report with recommended action plan
  • An onsite final presentation

 

 

By continuing to use the site, you agree to the use of cookies. more information

The cookie settings on this website are set to "allow cookies" to give you the best browsing experience possible. If you continue to use this website without changing your cookie settings or you click "Accept" below then you are consenting to this.

Close