Penetration Testing

Why is penetration testing necessary?

A penetration testing (or pentest) is a simulated hacking attempt against your IT infrastructure to identify and exploit possible security weaknesses before hackers do.

Simply put, we assume the role of an external or internal threat and choose the same arsenal rogue hackers would more likely use in the given situation to penetrate your organization’s network or application.

This is called ethical hacking which mimics real attack activity but are actually benign and will not harm or compromise your organization.

As a result, you receive a report email from us that begins with “G’day mate,” instead of a ransom email from a hacker calling you “Dear Sir/Madam”. (Well, you are right. Some hackers can craft a more beautiful email with even more of a personal touch to have you fall in love. Please don’t :P. )

External Penetration Testing

The traditional and more common approach to pen testing in terms of practicality is External Penetration Testing (or Pen Test). When performed against the target organization's web-facing/internet-accessible applications such as website, it is called Application Penetration Testing.

In layman's terms, Penetration Testing is a security exercise where a cyber-security specialist attempts to discover and exploit any weak spots in a system's defenses which attackers could take advantage of.

It is best conducted by external experts with little-to-no prior knowledge of how the system is developed and secured because they may be able to expose blind spots missed by the those who mainly focus on building the system.

Our External Penetration Testing is professionally performed from the perspective of an external malicious hacker who would be determined to find and exploit weaknesses in your system.

With our robust nondisclosure, absolute confidentiality and ethical considerations mechanism in place, the testing process, while mimicking real hackers' behaviour, will not harm, damage or compromise your organization, system, data or privacy. 

All our cyber-security tests are professionally performed from Australia in accordance with the best industry practice, latest known vulnerabilities, global trends, prognostic modelling, and well-established penetration testing methodologies, including among others:

• Pre-Engagement Walkthrough
• Reconnaissance & Footprinting
• Public Information & Data Leakage
• DNS Analysis, Check & Bruteforcing
• OS & web server fingerprinting
• Port & overall misconfiguration scanning
• Services Probing
• Human Oracle Involvement and Verification 
• Input/error handling, Metamorphic Testing 
• Intrusion Detection/Prevention/Defence Testing
• Password Testing
• Business Logic & Purchase Flow Integrity Testing
• Reporting and Documentation
• Post-Test Review
• (Optional) Remediation and Retesting

Website Penetration Testing

With incredibly fast adoption over the two decades, the Internet and web applications (websites) have not only reshaped how we interact with each other, but also has irreversibly transformed the way we live.

Web applications have become the most produced and used pieces of software, attracting more and more attention from both the business and hackers. 

The traditional and more common approach to the penetration testing of websites is External Penetration Testing. As part of the testing, we conduct a pre-engagement walkthrough, define the scope, coordinate the testing timeframe, and perform vulnerability assessment/penetration as per the arrangement. 

Our experts test your infrastructure for threats from all potential angles by assuming the role of a malicious hacker without any harm or damage to your system and under the absolute confidentiality or non-disclosure terms.