Our Approach to Pentesting

The objective of a pentest is to assess the security level of a defined target, through a concrete test reproducing the conditions of a real cyberattack.

We use our expertise in attack techniques to identify technical, logical, and human vulnerabilities in your information systems. The vulnerability exploitation phase allows us to determine the real risks for each situation, with the aim of mitigating them effectively and quickly. A penetration test is a tailor-made service, as attacks are designed based on the target's functional and technical architecture.

our approach penetration testing
01

Our Pentest Methodology

Our methodology is based on globally recognized standards, including the OWASP framework. We follow a 4-stage process:

  • Reconnaissance: Gathering information about the target.
  • Mapping: Understanding the structure of the target system.
  • Discovery: Identifying vulnerabilities in the system.
  • Exploitation: Testing the vulnerabilities in real-world scenarios.

By combining manual searches with automated tools, we can detect critical vulnerabilities that might otherwise be missed. Our experts focus on finding vulnerabilities that automated tools can't identify, such as logic flaws.

The result of every audit is a detailed report, outlining the vulnerabilities, their potential impact, and the necessary remediation actions. After fixing the flaws, we can perform a validation phase to ensure the issues have been resolved.

02

Focus on the Pentest Tools

The tools we use depend on the target of the penetration test. Here are some of the tools we deploy:

Web Application Pentest:
  • Burp Suite (Interception proxy)
  • SQLmap (Security flaw scanner)
  • WPscan, Drupscan (CMS-specific tools)
Internal Network Pentest:
  • Nmap (Port & services scanner)
  • Metasploit (Security flaw scanner)
  • Wireshark (Network analysis)
Reconnaissance Audit:
  • Google (Search engine)
  • Subfinder, Amass (DNS enumeration)
03

How Can We Define the Scope of a Pentest?

The scope defines the boundaries of the pentest. It can be highly specific, depending on the objective of the audit:

  • Black Box Pentest: No prior knowledge of the system; everything is discovered during reconnaissance.
  • Grey Box Pentest: Some knowledge of the system, typically targeting specific features or functions.

The scope is determined based on various factors such as business goals, certifications, or addressing a security incident. This ensures a tailored approach that aligns with your needs.