The objective of an external black-box penetration test is to harden the perimeter of your environment (firewall, VPN, etc.) as well as any external services that may be exposed to the internet (e.g. cloud infrastructure, DMZ services like email). Typically, this type of test is accompanied with a white-box security configuration audit of network security devices protecting your perimeter.
The CyberHunter Approach
The below description gives a generic overview of some of the areas that will be assessed:
For black-box penetration testing CyberHunter starts with methodologies based on the Penetration Testing Execution Standard (PTES) which can be summarized into the following steps:
Intelligence Gathering: In the first step of a penetration test, CyberHunter looks for as much information about the targets as possible. This includes identification of used devices, services and applications as well as the discovery of valid possible user accounts and other actions.
Vulnerability Analysis: Once all systems and applications are properly identified, CyberHunter performs analysis of found misconfigurations, design flaws, etc.
Exploitation: In this phase, CyberHunter attempts to exploit any weaknesses or vulnerabilities identified in discovered assets that are part of the penetration test scope. Cyberhunter will look to manually exploit any weaknesses or vulnerabilities identified in the servers or web application with the objective of breaching it from a black box perspective (i.e. no credentials or knowledge of the systems).
Post-exploitation: After gaining access to a compromised device/application, we attempt to establish full control of it, determine the usefulness of this device/application for next attacks and optionally make lateral movement further into a network.
Reporting: We provide a description of all discovered attack vectors along with their severity (based on complexity, probability, user interaction, etc.) and possible remediation steps.
All testing by CyberHunter is performed by a human using a blend of automated and manual procedures. We do not simply “scan and patch”.
Reporting and Deliverables:
Pen Testing Reports – Following any testing, a full detailed report shall be made available. The report will outline items such as the testing methods used, the findings, any proof-of-concept code for successful exploits, as well as remediation steps and suggestions.
Exploit Proof of Concept Development – In the event of a successful exploit, breach or compromise, CyberHunter shall document the testing methodology used, record all gathered evidence, and develop proof-of-concept exploits for repeatable testing.
Targeted Remediation Retest – Following the penetration testing, there may be one or more areas of weakness that requires reconfiguration, patching or replacement. CyberHunter will retest these areas when they are ready and remediation has been completed. Re-testing is included in this pricing if executed within 90 days of initial testing.
