External Infrastructure Testing

Corporate network perimeter security is essential and any security threats could lead to the compromise or abuse your external and possible internal infrastructure. This could impact negatively on your business and reputation. Our skilled security consultants, using proven and advanced methodologies, can help to identify, evaluate and remediate possible issues and ensure that you follow industry security best practices and standards.

The External Infrastructure Testing Methodology is divided into three distinct phases; Profiling, Assessment and Exploitation.

Profiling Phase

Information Gathering (Reconnaissance) techniques such as Enumeration, Footprinting, Fingerprinting and DNS/SMTP Reconnaissance will be performed to gather as much information as possible about the customer’s network Infrastructure and social structure.


Specifically, the following techniques will be used to find and assess any security-related information:-

Information Gathering (Reconnaissance)

Active Gathering

Passive Gathering

Port Scanning (TCP/UDP)

Visit Customer’s Websites

Ping Sweeps (TCP/ICMP)

Public Documents (Metadata)

Traceroutes (TCP/UDP/ICMP)

Search Engines

Common Protocol Queries (SNMP/SMB/IKE/LDAP/DB)

Whois Databases (IP/Domain)

DNS Lookups & Zonetransfers (Forward/Reverse/Bruteforce)

PGP Key-servers


Online Network Tools (Robtex, Netcraft)

SMTP Bounce Emails

Social Network & Blogs

OS & Service Fingerprinting

Mailing Lists, News Groups, Forums, Jobs Posting, IRC

Using Information Gathering techniques we will be able to profile customer’s network infrastructure and social structure as described below:-

Network Infrastructure

Social Structure

Host names - Including Domains, Subdomains, Virtual Hosts


Organization - Identifying organizational structure and security-related information such as Head-quarters/Office Addresses, Email Addresses, Departments/Roles, Services/Products, Phone/Fax Numbers and Documents

IP Addresses - All IP Addresses/Network blocks related to Customer’s Network


Network Devices - Including Firewalls(IDS/IPS/WAF), Routers, Switches, VPNs


Employees - Identifying employees contacts and public posts exposing technical and/or network information

Servers - Identifying any Server running within the network infrastructure (Such as Name, Email, Web, File, Database, Domain Servers)

Subsidiaries/Partners - Identifying organizations which shares same network resources with the customer’s organization

Exterior Routing - Identifying routing protocols and AS Numbers


Assessment Phase

Both automated and manual vulnerability assessment will be performed - based on the information found from the Profiling Phase - against the customer’s external infrastructure to ensure that all known and unknown vulnerabilities will be identified.

Specifically, the following vulnerability assessment techniques will be used:-

Vulnerability Assessment

Automated Assessment – Vulnerability Scanners will be used to identify potential risks.

Information Leakages – Applications can unintentionally leak information about their configuration or internal workings (E.g. Banners exposing version details / Error messages reveal SQL syntax etc.).


Input Validation – An assessment for input validation will be performed to identify application and services that fail to fully validate the input they receive from users (E.g. Buffer Overflows, SQL Injections etc.).

Misconfigurations – Misconfigured security settings, particularly insecure default settings, are usually easily exploitable.


Lack of Patching – Identifying the out-of-date systems and services.

Insecure Protocols – Identifying protocols which allow authentication credentials to travel in clear-text format and are vulnerable to sniffing attacks.

Exploitation Phase

At the exploitation stage we will try to exploit and validate the existence of the identified vulnerabilities. Both online and offline password cracking techniques (e.g. Guessing, Dictionary, Hybrid, Brute-force) will be performed against password hashes (e.g. MD5) and/or authentication points found from previous steps of testing. In case of successful exploitation we will try to escalate privileges within applications, hosts and networks.