Penetration Testing

Simulate a real-world cyber-attack through hands-on penetration testing and exploitation to assess your existing security controls and processes. Find out how penetration testing is a necessity when it comes to securing your business’s infrastructure.

Get Started

A deeper dive on security.

Identification and Exploitation

Identification and exploitation of weaknesses in your business’s digital infrastructure. Develop security controls, determine business risk and actively remediate findings before they are exploited by a threat actor.

Assess Preventative Measures

Penetration testing will thoroughly assess whether existing preventative measures are effective to real-world attacks through a hands-on, manual attack simulation.

In-Depth Analysis

The manual security testing approach allows us to not only discover security weaknesses and flaws within your business environment but provide insight on potential risk with a greater understanding of the vulnerability context.

Our Methodology

Penetration Testing Methodology Icons Image

Pre-Engagement

An initial discussion on the assessment scope, understanding any compliance requirements, the overall threats associated with your business and when the penetration testing should be conducted.

Reconnaissance

The in-depth information-gathering phase. The collected data is utilised in the following exploitation phase and allows the testers to gain an understanding of the target and construct potential attack vectors.

Exploitation

Analysing gathered information, any potential vulnerabilities, attempting to circumvent preventative measures and delivering exploitation payloads. If successful, the finding is documented.

Comprehensive Reporting

A clear and concise report with an executive summary. Each finding is documented along with its associated severity and business impact, steps needed to reproduce, any supporting evidence and remediation advice.

Retesting and Support

A post-engagement remediation meeting is held. Clearfin will be available for remediation guidance and will conduct retesting to ensure determined vulnerabilities have been appropriately patched.

Our Methodology

Pre-Engagement

An initial discussion on the assessment scope, understanding any compliance requirements, the overall threats associated with your business and when the penetration testing should be conducted.

Reconnaissance

Exploitation

Analysing gathered information, any potential vulnerabilities, attempting to circumvent preventative measures and delivering exploitation payloads. If successful, the finding is documented.

Comprehensive Reporting

Retesting and Support

A post-engagement remediation meeting is held. Clearfin will be available for remediation guidance and will conduct retesting to ensure determined vulnerabilities have been appropriately patched.

Our Methodology

Pre-Engagement

An initial discussion on the assessment scope, understanding any compliance requirements, the overall threats associated with your business and when the penetration testing should be conducted.

Reconnaissance

Exploitation

Analysing gathered information, any potential vulnerabilities, attempting to circumvent preventative measures and delivering exploitation payloads. If successful, the finding is documented.

Comprehensive Reporting

Retesting and Support

A post-engagement remediation meeting is held. Clearfin will be available for remediation guidance and will conduct retesting to ensure determined vulnerabilities have been appropriately patched.

Common targets:

Web Application

Web application penetration testing is a manual approach to assess the underlying architecture, site configuration and overall design of the web applications in scope. Web app penetration testing includes, but is not limited to:

In-depth Discovery
Vulnerable Libraries and Components
Injection Flaws
Vulnerable Software
Authentication and Session Issues
Information Leakage

Network Infrastructure

Network penetration testing involves fingerprinting devices and infrastructure on a given network and attempting to exploit vulnerabilities on the underlying software. Network penetration testing includes, but is not limited to:

Asset Identification
Host Discovery and Port Scanning
Outdated and EOL Software
Protocol Level Vulnerabilities
Encryption Weaknesses
Vulnerable Software

Testing perspective:

Internal Network

This form of penetration testing identifies vulnerabilities that may exist beyond your primary security perimeter. Internal penetration testing identifies security weaknesses from inside your business’ network.

External Network

This penetration testing type assesses your external security perimeter from the perspective of an outside attacker. Vulnerabilities identified here will be public-facing and available to everyday internet threats.

Engagement scenarios:

White Box

Full in-depth knowledge and information on the target scope. While not as realistic as the black box perspective, it allows for a very thorough yet time-consuming test.

Full testing perspective.
Usage of documentation.
Work with developers.
Source code on-hand.
Testing IP addresses are whitelisted.

Black Box

Zero-knowledge of the target scope. More indicative of a real-world attack, however, is less likely to expose all vulnerabilities. Preventative security infrastructure will remain operational throughout the testing.

Intrusion detection systems (IDS) remain operational.
Firewalls remain operational.
Attempt to bypass security infrastructure.
No authentication details given.
No whitelisting given.

Grey Box

The most popular perspective of testing; a balanced approach between black box and white box. A grey box test discloses just enough information to perform a thorough and methodical test while keeping the scenario relevant and realistic.

Testing IP addresses are whitelisted.
Provided documentation where neccessary.
Limited developer knowledge.
Full testing perspective.

Request a sample report.

We take pride in our ongoing security research and vulnerability documentation. Our unique reporting and management process ensures that remediation is as frictionless as possible. Leave us your email below to request a sample report.

We use fully accredited testers.

Frequently Asked Questions

What is the difference between vulnerability scanning and penetration testing?

Will this cause any disruption to my service?

How long does a penetration test take?

What vulnerabilities are covered in a penetration test?

Speak to an expert today.

Get in Touch