Simulating employee actions
Gray Box Testing
Complete List of Vulnerabilities with Recommendations for Remediation
Post-Penetration Testing Support
What is an internal pentest?
An internal pentest involves simulating the actions of an attacker who has access to the company’s internal network and is attempting to gain access to protected information. In general, internal penetration testing is conducted using the Gray box model (the pentester has the rights of an ordinary employee).
When is an internal penetration test conducted?
When checking the security of yourITinfrastructure
an internal penetration test will help you check how well your infrastructure is protected from the inside
After making significant changes to the IT infrastructure,
an internal penetration test can identify new vulnerabilities that have arisen after the infrastructure update
If you suspect data leaks or security incidents
if there are suspicions of confidential data leaks, an internal pentest will help identify vulnerabilities and eliminate them before another incident occurs.
Before certification or audit, as well as compliance with regulatory requirements
Performing an internal pentest will help you prepare for a regulatory compliance check.
Internal pentest tools
While working on projects, we often create our own tools: we write scripts, exploits, and automate routine tasks for a specific project.
Detailed review and manual analysis
- BurpSuite
- Bloodhound
- Certipy
- Linux console utilities
- Python/Bash/Go
Universal vulnerability scanners
- Nmap
- crackmapexec/netexec
- Metasploit
- PingCastle
- Nuclei
- Responder
Workflow
- Search for information available to ordinary employees
- Increasing access rights and securing them in the infrastructure
- Gathering information about internal resources
- Analysis and identification of vulnerabilities in the IT infrastructure
- Exploiting vulnerabilities in consultation with the client
- Preparation of a detailed report with routes through which an attacker can gain access to protected information and a detailed plan for eliminating them
Main areas of verification
- Identification of outdated software components
- Insecure storage and transmission of password information
- Detection of excessive user rights
- Verification of antivirus protection
- Attacks on network infrastructure
- Attacks on services, including AD and operating systems
What you get
The result of an internal penetration test is a report consisting of:
Summary A general description of the penetration test results without using specialized terminology, but with an assessment of the criticality of the vulnerabilities identified
Technicalreport Detailed information about attack vectors, supported by screenshots, about the vulnerabilities found, their exploitation, and ways to eliminate them
Expert opinion
This section contains information on individual ways to improve information security, taking into account the client’s business processes.
What to do with the report:
Analyze the results. Carefully study the report to understand the identified vulnerabilities, potential consequences, and recommendations for eliminating them.
Develop an action plan Create an action plan to address the identified vulnerabilities. Set deadlines and assign responsibilities to ensure that each issue is addressed appropriately.
Fix vulnerabilities Take steps to address the identified vulnerabilities in accordance with the action plan.
Repeattesting After fixing the vulnerabilities, repeat the penetration test to make sure the issues have been successfully fixed and the system is now secure.
Advantages of ITGLOBAL.COM Security
We have all the necessary certificates.
External penetration testing is performed by specialists who have international certificates: OSCP, OSCE, OSWE, CEH.
We ensure compliance with the requirementsof the followingstandards:
PCI DSS, 719-P, 683-P, 757-P, 742-P, 802-P, and GOST R 57580
Proprietary testing methods
More than 40 proprietary methods for conducting internal penetration testing
Post-service support
We continue to advise you after the penetration test to help eliminate vulnerabilities identified in the process
Proven experience
10 years of practical experience, real case studies from our clients, and all necessary FSB and FSTEC licenses
Our clients
