Internal Penetration Testing
- Home
- /
- Internal Penetration Testing
An internal network with high value data is always a big bounty for cyber attackers as they steal, encrypt, delete data to damage your business reputation. The conventional automated scanners don’t really help to uncover the whole threat landscape.
Our pen testers start the Internal pentesting with a standard normal user account in your system and then use that to build the use cases to exploit identified vulnerabilities. We try to take admin control of one or many assets inside your organization and then propagation of attack from one system to another, hence testing the overall network from inside. We test your environment from within with assumption that a threat vector is already inside your environment and mimic all possible action it can do to your assets.
Step 1: Kickoff and Scope Agreement
Once we receive the query from your side on app PenTest, we organize a virtual meet or in-person meet at your office to discuss about the goals and deliverables you want. In this meeting the scope will be discussed and finalized. The target completion date (generally 2 weeks) will be fixed along with exclusions from testing.
Step 2: Execution
Our Pentesters immediately try to take advantage of “low hanging fruit” inside your environment like unpatched systems, wrong configurations of VLAN, insecure machines, weak credentials (easy to brute force), assets running on default credentials, misconfigured policies on active directory, internal dns and dhcp servers, poorly configured roles on file and ftp servers, insecure IP devices which runs outdated firmware etc. Once we get hold of one device, we try to move laterally inside the network from one hop to another. This step exposes weakness of your internal infrastructure.
We will then present the loopholes in your exposed assets in our comprehensive penetration test report. We will categorize the risks into 5 main buckets.
Internal network test takes one week.
