Penetration testing
We check how far an attacker gets: from the internet, from the office network or with an employee’s account. We confirm findings within the agreed scope and show the attack path to critical systems.
- CriticalCode execution on an unpatched VPN gatewayCVSS 9.8
- HighKerberoasting: a service account with a dictionary passwordAD
- HighDefault password on the video surveillance panelCVSS 8.1
- MediumOpen directory with website backupsCVSS 5.3
- LowWeb server version in response headersCVSS 3.1
An attack path from the internet through the VPN gateway to the domain controller
What we test
- External perimeter
- Websites, VPN, mail and remote access services visible from the internet. We look for a way into the internal network.
- Internal network
- An attack from an employee workstation or a guest connection: Active Directory, servers, network segmentation.
- Wireless networks
- Corporate and guest Wi-Fi: isolation, authentication, rogue access points.
- Social engineering
- Phishing emails and calls under an agreed scenario: we test how staff and processes respond to an attack.
- Physical access
- Getting into the office and plugging into the network on site, if the contract includes it.
Photographs
Photos: Lacz02, CC BY-SA 4.0; Markus Spiske, CC0; BrokenSphere, CC BY-SA 3.0; Derrick Coetzee, CC0, Wikimedia Commons.
Testing models
Black box
We know only the company name and its internet addresses, like an outside attacker. Shows what is visible from outside.
Grey box
We get an employee or customer account. Shows what an intruder does with a stolen password.
White box
We get network diagrams, configurations and a line to your administrators. Gives the widest coverage in the same time.
How the work goes
- 01
Scope
We agree goals, addresses, timing, permitted techniques and emergency contacts. We sign the contract and the testing authorisation.
- 02
Reconnaissance
We gather information about the company, its staff and services from open sources.
- 03
Vulnerability search
We scan and test by hand: a scanner does not find vulnerability chains or logic flaws.
- 04
Exploitation
We confirm vulnerabilities within the agreed scope and build the attack path. Checks that could disrupt services are agreed in advance.
- 05
Report
We walk your team through the report. After the fixes we retest the vulnerabilities we found.
What you get
- A management report: business risks and remediation deadlines.
- A technical report: vulnerabilities with evidence, reproduction steps and recommendations.
- The attack path on a diagram: from the entry point to critical data.
- A retest after the fixes.
Questions
Ask your own questionHow is a penetration test different from a vulnerability scan?
A scanner finds known vulnerabilities by software version. A penetration tester checks whether they can be exploited, chains weak points together and shows the attack path.
Will systems stop working during the test?
Risky checks are agreed in advance and run at a time that suits you. During the work you have a contact who stops the testing on your signal.
How long does a penetration test take?
It depends on the scope: the number of addresses, applications and network segments. We name the exact timeline once the scope is agreed.
Discuss your task
Describe the task and the timeline. We will reply, clarify the scope and propose a plan.
- Contract. We start with a contract and a non-disclosure agreement. The scope of work and the permissions are put in writing.
- Scope. Goals, systems, timing and emergency contacts are agreed before the work starts.
- Work. We keep you updated as the work goes and report critical findings at once.
- Report. We hand over a management report and a technical report with evidence and recommendations.
Or write to us: info@dozorsecurity.kz