It is very common for organisations having a secure external infrastructure but they overlook for organisation's internal infrastructure security. However, according to facts more attacks originate from within the company and tend to be a lot more expensive than external attacks. We can help you to prevent unauthorised accesss to your internal systems and resources from internal or even external intruders that were able to copromise the external infrastructure. |
The Interal Infrastructure Testing
Methodology is divided into three distinct phases; Profiling, Assessment and
Exploitation.
Profiling Phase
Information Gathering (Reconnaissance) techniques such
as Enumeration, Footprinting, Fingerprinting and
DNS/SMTP Reconnaissance will be performed to gather as much information as
possible about the customer’s corporate network.
Specifically, the following techniques will be used to
find and assess any security-related information:-
Information Gathering (Reconnaissance) |
|
Port Scanning (TCP/UDP) |
Common Protocol Queries (SNMP/SMB/IKE/LDAP/DB) |
Ping Sweeps (TCP/ICMP) |
OS & Service Fingerprinting |
Traceroutes (TCP/UDP/ICMP) |
Active Directory User Enumeration |
DNS Lookups & Zonetransfers (Forward/Reverse/Bruteforce) |
Passive Sniffing |
SMTP Enumeration (VRFY, EXPN, MAIL FROM/RCPT TO) |
Using the
above Information gathering techniques we will be able to profile customer’s network
as described below:-
Network
Infrastructure |
Social Infrastructure |
Host names – Including Domains, Subdomains, Virtual Hosts |
Servers – Identifying any Server running within the
network infrastructure (Such as Name, Email, Web, File, Database, Domain
Servers) |
IP Addresses – All IP Addresses/Network blocks related to
Customer’s Network |
|
Network Devices – Including Firewalls(IDS/IPS/WAF), Routers,
Switches, VPNs |
Interior Routing – Identifying interior routing protocols |
Assessment Phase
Both automated and manual
vulnerability assessment will be performed - based on the information found
from the Profiling Phase - against the customer’s internal infrastructure to
ensure that all known and unknown vulnerabilities will be identified.
Specifically, the following vulnerability assessment
techniques will be used:-
Vulnerability Assessment |
|
Automated Assessment – Vulnerability Scanners will
be used to identify potential risks. |
Information Leakages – Applications can
unintentionally leak information about their configuration or internal
workings (E.g. Banners exposing version details / Error messages reveal SQL
syntax etc.). |
Input Validation – An assessment for input
validation will be performed to identify application and services that fail
to fully validate the input they receive from users (E.g. Buffer Overflows,
SQL Injections etc.). |
Misconfigurations – Misconfigured security
settings, particularly insecure default settings, are usually easily
exploitable. |
Lack of Patching – Identifying the out-of-date systems and
services. |
Insecure Protocols – Identifying protocols which
allow authentication credentials to travel in clear-text format and are
vulnerable to sniffing attacks. |
Exploitation Phase
At the exploitation stage we
will try to exploit and validate the existence of the identified
vulnerabilities. Both online and offline password cracking techniques (e.g.
Guessing, Dictionary, Hybrid, Brute-force) will be performed against password
hashes (e.g. LM/NTLM) and/or authentication points found from previous steps of
testing. In case of successful exploitation we will try to escalate privileges
within applications, hosts and networks.