Infrastructure Penetration Testing

Infrastructure penetration test aims to assess your network for vulnerabilities and security issues in servers, hosts, devices and network services.

Infrastructure Penetration Test?

Is an authorized hacking attempt designed to uncover and exploit network vulnerabilities and gain access to an organization’s information assets. The testing process is followed by a comprehensive report prioritizing vulnerabilities and outlining actionable mitigation strategies.

SUD0ROOT staff take on the role of an external or Internal attacker and attempt to exploit vulnerable systems to obtain confidential information compromise the network perimeter. We build scenarios utilizing the compromised system as a pivot point to further penetrate the network infrastructure, to demonstrate the potential impact of a successful compromise.

Infrastructure security testing generally includes:

Insecure configuration parameters
Weak security controls
Insecure firewall rules
SCADA Infrastructure flaws

Unpatched systems
The presence of malware
Software flaws
IoT Devices flaws

Internal network penetration testing

White-box

An internal network pen test is performed inside a network to help gauge whether an employee or contractor could successfully conduct an insider attack, and the potential damage such an attack could cause.

This generally includes:

Tests from the perspective of both an authenticated and non-authenticated user to assess potential exploits.
Assesses the vulnerabilities that exist for systems that are accessible to authorized login IDs and that reside within the network.
Checks for misconfigurations that would allow employees to access information and inadvertently leak it online.

External network penetration testing

Black-box

An external network pen test is designed to test the effectiveness of perimeter security controls as well as identify weaknesses affecting all other external-facing systems, such as web, mail and FTP servers

This generally includes:

Identifying and assessing all Internet-facing assets a criminal hacker could use as potential entry points into your network.
Assessing the effectiveness of your firewalls and other intrusion-prevention systems.
Establishing whether an unauthorized user with the same level of access as your customers and suppliers can gain access to your systems via the external network.